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ABSTRACT 


Manual  flight  control  systems  are  described  In  which  the  sole  means  of 
control  between  the  pilot's  station  and  the  control  actuator  is  in  the  form 
of  electrical  signals.  No  mechanical  control  links  are  used  in  the  system. 

Such  a  system  where  vehicle  motion  is  the  controlled  parameter  is  defined  as 
a  fly -by -wire  control  system.  Because  of  the  growing  number  and  severity  of 
problems  in  mechanical  control  systems,  particularly  in  large  and  high  speed 
aircraft,  fly-by-wire  systems  are  evolving  out  of  necessity.  Fly-by-wire 
control  is  shown  to  provide  many  advantages  over  conventional  mechanical  flight 
control  systems.  Principally,  they  are  reduced  weight  and  volume.  Improved 
control  performance,  reduced  design  effort  and  maintenance  time,  the  feasibility 
of  standardizing  flight  control  systems,  and  reduced  vulnerability.  System 
design  requirements  and  tradeoffs  are  discussed  such  as  the  types  of  components 
used,  control  signal  format,  method  of  transmitting  signals,  actuator  con¬ 
figurations,  degrees  of  redundancy,  failure  detection  techniques,  and  artificial 
feel  mechanization.  Examples  are  given  of  the  application  of  fly -by-wire  con¬ 
trol  to  various  classes  of  aircraft.  The  primary  benefits  derived  depend  dn  the 
class  of  aircraft.  Control  system  technology  has  reached  the  point  where 
practical  fly -by-wire  system  designs  can  be  realized  today.  The  next  logical 
step  in  its  development  is  to  build  and  fly  a  fly-by-wire  system  to  demonstrate 
its  feasibility  and  after  many  flight  hours  to  provide  in-flight  proof  of  its 
maturity . 

(This  document  is  subject  to  special  export  controls  and  each  transmittal  to 
foreign  governments  or  foreign  nationals  may  be  made  only  with  prior  approval 
of  the  AF  Flight  Lynamics  Laboratory  (FDCL).) 


ill 


r— 


TABLE  OF  CONTENTS 


Section  Page 

I  INTRODUCTION .  1 

II  SOURCES  OF  DATA  .  3 

1 .  Literature . 3 

2.  Plant  Visits .  3 

3.  Reliability:  The  Numbers  Game .  4 

III  HISTORICAL  PERSPECTIVE  AND  PROBLEM  DISCUSSION .  7 

1.  Flight  Control  System  Development .  7 

a.  Control  Linkages .  7 

b.  Mechanical  Control  Systems  Problems .  8 

c.  Artificial  Feel .  16 

2.  Previous  Fly -By -Wire  Work .  32 

a.  Funded  Studies .  32 

b.  In-House  Studies... .  43 

c.  Applications .  45 

3 .  Related  Work .  49 

IV  DISCUSSION  OF  FLY-BY -WIRE  CONTROL .  55 

1.  Introduction .  55 

2.  Benefits  of  Fly-By-Wire .  55 

3.  Fly -By-Wire  Systems  Descriptions .  60 

4 .  Development  of  Fly-By-Wire .  66 

V  DESIGN  CONSIDERATIONS  AND  SYSTEM  COMPONENTS .  67 

1.  Design  Considerations .  67 

2.  Control  Stick .  69 

a.  Introduction..... .  69 

b.  Moving  Versus  Rigid  Stick .  82 

c.  Controller  Size  and  Shape .  82 

d.  Articulation.... .  82 

e .  Trim  Control .  83 

f .  Requirements  for  Adjustability .  84 

g.  Typical  Sidc8blck .  84 

3*  Transducers . 88 

4.  Transmission  Line .  90 

5.  Summing  Junctions .  92 

6.  Electronics .  93 

7.  Actuators . 97 

8.  Aircraft  Motion  Sensors .  100 


v 


r 


TABLE  OF  CONTENTS  (cont) 


Section  Page 

VI  SYSTEM  DESIGN .  103 

1.  System  Design  Criteria .  103 

2.  System  Constraints . 103 

3-  Additional  Considerations .  104 

4.  Tradeoffs .  105 

a.  System  Tradeoffs .  105 

b.  Degree  of  Redundancy .  105 

c.  Actuator  Tradeoffs .  107 

5.  Actuator  Configurations .  114 

a.  Model  1.  Spool -Monitored  (Electrical) 

Standby  Redundant  Actuator .  n4 

b.  Model  2.  Spool-Monitored  (Hydraulic) 

Standby  Redundant  Actuator .  nj 

c.  Model  3.  Secondary  Actuator  With  Standby 

Redundancy .  117 

d.  Model  4.  Fail-Passive  Secondary  Actuator  .  121 

e.  Model  5*  Posit ion -Monitored  Standby 

Redundant  Actuator .  125 

f.  Model  6.  Position-Monitored  (Hydraulic) 

Standby  Redundant  Actuator .  127 

g.  Model  7-  Force-Summed  Voted  Actuator .  I29 

6 .  Candidate  Systems  . .  130 

VII  SIMULATION  STUDY .  137 

1.  Breadboard  Model .  I37 

2.  Secondary  Actuator  Approach .  148 

3.  The  Fail-Passive  Actuator  Approach .  167 

VIII  COMPARISON  OF  MECHANICAL  AND  FLY-BY-WIRE  SYSTEMS .  187 

1.  B-52H  Flight  Control  System  .  187 

2.  F-lll  Flight  Control  System .  203 

3.  CH-U6  Flight  Control  System .  226 

IX  CONCLUSIONS  AND  RECOMMENDATIONS .  237 

1.  Conclusions . 237 

2.  Recommendations .  240 

X  GLOSSARY  OF  TERMS .  24l 

XI  REFERENCES  AND  BIBLIOGRAPHY .  249 

APPENDIX  XB-70A  PITCH  AND  ROLL  CONTROL  SYSTEM  SCHEMATIC  .  255 


vi 


rH  CM  CO-4-  IfNNO  t-OO  ON  O  r— l  CM  CO-4-  ICNNC  t—  CO  ON  O  iH  CM  CO-4-  LCNVO  t—  CO  ON  O  rH  CM  CO -4"  t— CO  ON  O  r-i 

HrlHrlrlHrlrl  H  H  CM  CM  CMCMCMCMCMCMCJCM  OO  CO  COfOOOCOCOCOCO  CO-4-  -4- 


LIST  OF  ILLUSTRATIONS 


Figure  No.  Title  Page 

Simplified  Aircraft  Control  System  .  9 

Fully  Powered  (irreversible)  Control  System  .  9 

Parallel  Input  Servo  .  9 

Series  Input  Servo  .  10 

Dual  Valve  Input .  10 

Differential  Servo  Type  of  Control  Stick  Steering .  10 

Force  Stick  Type  of  Control  Stick .  11 

Fly-By-Wire  Control  System  .  11 

F-lll  Pitch/Roll  Mechanical  Control  System .  13 

Elevator  Stick  Force  Requirement .  19 

Constant  Stick  Force  Gradient .  20 

Aircraft  Response  to  Slow  and  Fast  Inputs .  22 

Irreversible  Control  System . 23 

Stick  Force  Gradients  .  26 

q-Spring  Artificial  Feel .  27 

Dynamic  Pressure  VersuB  Airspeed  .  28 

Stick  Force  For  Each  Steady-State  Acceleration, 

Lockheed  SST .  29 

Normal  Acceleration  Characteristics,  Lockheed  SST  .  31 

Schematic  Diagram  -  Douglas  Electrical  Flight 

Control  System  .  33 

Electrical  Schematic  -  Douglas  Electrical  Flight 

Control  System .  36 

Douglas  Electrical  Primary  Flight  Control  System  - 
Electrical  Circuit  Diagram  of  One  Channel 

(Typical  of  Three)  .  37 

Kaman  HH-U3E  Flight  Control  System  .  39 

Kaman  EFCS  Fractional  Schematic,  Lateral  Cyclic  Axis .  Uo 

Kaman  EFCS  Functional  Schematic,  Collective  Pitch  Axis....  kl 

X-20  Elevon  Control  System  Block  Diagram .  hj 

Equivalent  Fly-By-Wire  System  .  56 

XB-70  Pitch  Axis  Control  System .  58 

XB-70  Roll  Axis  Control  System  .  59 

Simplified  Block  Diagram  of  Fly-By-Wire  Control  System  - 

Pitch  Axis  .  6l 

Simplified  Block  Diagram  of  Fly-By-Wire  Control  System  - 

Roll  Axis  .  62 

Simplified  Block  Diagram  of  Fly-By -Wire  Control  System  - 

Yaw  Axis .  63 

General  Fly-By -Wire  Configuration .  70 

Trim  Technique .  85 

Sidestick  Controller .  86 

Quadruplex  Tandem  Linear  Transformer .  91 

Reentry  Vehicle  SAS .  96 

Typical  Microelectronic  Subassembly .  98 

Typical  Microelectronic  Card  Assemblies .  99 

Model  1 .  IX5 

Model  3A .  Il8 

Model  3B .  119 


vii 


LIST  OF  ILLUSTRATIONS  (cont) 


Figure  No.  Title  Page 

42  Model  4A .  122 

43  Model  4b .  123 

44  Model  5 .  126 

45  Model  6 .  128 

46  Model  7 .  131 

47  Block  Diagram  for  Secondary  Actuator  Concept .  139 

48  Block  Diagram  for  Fail-Passive  Concept .  l4l 

49  Block  Diagram  for  Spool -Monitored  Concept .  143 

50  The  Breadboard  Simulation . 145 

51  Fail-Safe  Comparator  .  146 

52  Logic  and  Switching  Diagram  •  •  . . 147 

53  Secondary  Actuator  Concept  Analog  Diagram .  149 

54  Comparison  of  Actual  Switching  and  Simulated 

Switching  in  the  Secondary  Actuator .  153 

55  Secondary  Actuator  at  Low  Dynamic  Pressure, 

10  ms  Swltch/Open  Input .  155 

56  Secondary  Actuator  at  Low  Dynamic  Pressure, 

25  ms  Switch/Open  Input- . . .  156 

57  Secondary  Actuator  at  Low  Dynamic  Pressure, 

50  ms  Switch/Open  Input .  157 

58  Secondary  Actuator  at  Low  Dynamic  Pressure, 

10  ms  Switch/Open  Feedback .  158 

59  Secondary  Actuator  at  Low  Dynamic  Pressure, 

25  ms  Switch/Open  Feedback .  159 

60  Secondary  Actuator  at  Low  Dynamic  Pressure, 

50  ms  Switch/Open  Feedback .  160 

61  Secondary  Actuator  at  High  Dynamic  Pressure, 

10  ms  Switch/Open  Input .  l6l 

62  Secondary  Actuator  at  High  Dynamic  Pressure, 

25  ms  Switch/Open  Input .  162 

63  Secondary  Actuator  at  High  Dynamic  Pressure, 

50  ms  Svitch/Open  Input .  163 

64  Secondary  Actuator  at  High  Dynamic  Pressure, 

10  ms  Switch/Open  Feedback .  l64 

65  Secondary  Actuator  at  High  Dynamic  Pressure, 

25  ms  Switch/Open  Feedback .  165 

66  Secondary  Actuator  at  High  Dynamic  Pressure, 

50  ms  Switch/Open  Feedback .  l66 

67  Electronics  Test  Bed  .  l68 

68  Electrohydraulic  Test  Bed .  169 

69  Fail-PaBsive  Actuator  Concept  Analog  Diagram  .  171 

70  Fail-Passive  Actuator  at  Low  Dynamic  Pressure .  175 

71  Fail-Passive  Actuator  at  Low  Dynamic  Pressure, 

One  Failure . 176 

72  F'iil-Passive  Actuator  at  Low  Dynamic  Pressure, 

Two  Channels  Failed .  177 

73  Fail-Passive  Actuator  at  Low  Dynamic  Pressure, 

1-Hertz  Input  .  178 


v!Ii 


LIST  OF  ILLUSTRATIONS  (cont) 


Figure  No.  Title  Page 

jk  Fail-Pft6sive  Actuator  at  Low  Dynamic  Pressure, 

4-Hertz  Input  .  179 

75  Fail-Passive  Actuator  at  High  Itynamic  Pressure .  l8o 

76  Fail-Passive  Actuator  at  High  Dynamic  Pressure, 

One  Failure . * .  1®1 

77  Fail-Passive  Actuator  at  High  Dynamic  Pressure, 

Two  Channels  Failed .  102 

78  Fail-Passive  Actuator  at  High  Dynamic  Pressure, 

1 -Hertz  Input  . 184 

79  Fail-Passive  Actuator  at  High  Dynamic  Pressure, 

4-Hertz  Input . 105 

80  B-52H  Elevator  Control  System  (Mechanical) .  189 

81  B-52H  Elevator  Control  System  (Fly -By -Wire) .  190 

82  B-52H  Roll  Control  System  (Mechanical) .  193 

83  B-52H  Spoiler  System  (Mechanical) .  194 

84  B-52H  Roll  Control  System  (Fly-By -Wire)  .  196 

85  B-52H  Rudder  Control  System  (Mechanical)  .  201 

86  B-52H  Rudder  Control  System  (Fly -By -Wire) .  202 

87  F-lli  A/B  Flight  Control  Schematic  (Mechanical) .  209 

88  F-lll  A/B  Flight  Control  Schematic  (Fly-By-Wire) .  211 

89  CH-46A  Flight  Control  -  Block  Diagram .  227 

90  CH-46  Fly-By-Wire  System  -  Simplified  Block  Diagram .  229 

91  Fly-By-Wire  Implementation  Longitudinal  Axis .  231 

92  XB-70A  Pitch  and  Roll  Control  System  Schematic .  257 


LIST  OF  TABLES 

Table  No.  Title  Page 

I  Summary  of  Transducer  and  Sensor  Types . 71 

II  Summary  of  Component  Characteristics .  75 

III  Transducer  and  Sensor  Requirements  for  Fly-By-Wire  Systems  8l 

IV  Mechanical  Performance  Characteristics  of  the  Sidestick 

Controller .  87 

V  Summary  Comparison  of  Actuator  Configurations .  135 

VI  Secondary  Actuator  Simulation  Potentiometer  Settings .  151 

VII  Fail-Passive  Actuator  Simulation  Potentiometer  Settings. . .  173 

VIII  B-52H  Elevator  Control  System  Weight  and  Cost .  191 

IX  B-52H  Roll  Control  System  Weight  and  Cost .  . 

X  B-52H  Rudder  Control  System  Weight  and  Cost .  205 

XI  B-52H  Mechanical/Fly -By -Wire  Control  System  Comparison -  207 


ix 


LIST  OF  TABLES  (cont) 


Table  No.  Title  Page 

XII  F-lll  Pitch  Control  System  Weight  and  Cost .  213 

XIII  F-lll  Roll  Control  System  Weight  and  Cost .  217 

XIV  F-lll  Yaw  Control  Systf.m  Weight  and  Cost  .  221 

XV  F-lll  Mechanical/Fly-By-Wire  Control  System  Comparison....  225 

XVI  Summary  of  Estimated  Component  Failure  Rates .  234 

XVII  Summary  of  Fly -By-Wire  System  Reliability .  234 

XVIII  Maintainability  Estimate .  235 


x 


SECTION  XII 


LIST  OF  SYMBOLS  AND  ABBREVIATIONS 


SYMBOLS 

A 


C 


m 


'm  I, 


Joc 


z'e 

F 

F„ 

8 

G 

g 

I 

Iyy 

M 

M. 


Mq 

*w 

Mw 


Actuator  piston  area 

Constants  to  describe  airframe  characteristics 

Blend  of  pitch  attitude  rate,  pitch  attitude  acceleration, 
and  normal  acceleration 

Mean  wing  chord 

Pitching  moment  coefficient  due  to  angle  of  attack 
Pitching  moment  coefficient  due  to  elevator 
Normal  force  coefficient  due  to  angle  of  attack 

Normal  force  coefficient  due  to  elevator 

Force 

Control  stick  force 

Transfer  function  or  variable  gain 

Gravity 

Servo  amplifier  current 

Pitch  axis  moment  of  inertia 

Constants  to  describe  airframe  characteristics 

Mass,  Mach  number 

Pitching  moment  due  to  elevator 

Pitching  moment  due  to  pitch  rate 
Pitching  moment  due  to  normal  acceleration 
Pitching  moment  due  to  normal  velocity 


xi 


> 


n 


Load  factor 


M 


o 


n 


z 


P 


Q 


q 

s 


8 

t 


“O'  vo 
V 


XCG 


e 


i 


0 


u 


Aircraft  neutral  point 
Aircraft  normal  acceleration 
Pressure 
Flow  rate 

Dynamic  pressure,  pitch  attitude  rate 
Wing  surface  area 
Laplace  operator 
Time 

Aircraft  steady-state  longitudinal  velocity 
Change  in  aircraft  velocity 

Aircraft  center  of  gravity  in  percent  of  mean  chord 
Aircraft  normal  force  due  to  normal  velocity 
Aircraft  normal  force  due  to  elevator 

Angle  of  attack 

Change  in  stabilizer  position 

Intermediate  actuator  displacement 

Elevator  deflection 

Control  stick  displacement 

Damping  ratio 

Pitch  attitude  rate 

Air  density 

Angular  velocity,  constant  UBed  in  aircraft  description 


ABBREVIATIONS 

AAFSS 

Advanced  aerial  fire  support  system 

AFCL 

Advanced  flight  control  linkage 

AFCS 

Automatic  flight  control  system 

AMSA 

Advanced  manned  strategic  aircraft 

AWL 

All -weather  landing 

BITE 

Built-in  test  equipment 

CAS 

Command  augmentation  system  or  control  augmentation  system 

EFCS 

Electrical  flight  control  system 

FBW 

Fly-by-vire 

IHAS 

Integrated  helicopter  avionics  system 

LEM 

Lunar  excursion  module 

LRU 

Line  replaceable  unit 

LVET 

Linear  variable  differential  transformer 

MTBF 

Mean  time  between  failures 

PIO 

Pilot  induced  oscillations 

RIG 

Rate  integrating  gyro 

SAS 

Stability  augmentation  system 

SST 

Supersonic  transport 

VTOL 

Vertical  takeoff  and  landing  aircraft 

SUBSCRIPTS 

« 

Error  signal 

M 

Signal  has  been  Bhaped 

SECTION  I 


INTRODUCTION 


Aircraft  design  is  about  to  enter  a  new  era  in  which  the  mechanization  of 
flight  control  systems  will  be  electrical  rather  than  mechanical.  Electrical 
flight  control  systems  are  commonly  known  as  fly -by -wire  systems.  They  will 
be  integrated  with  the  automatic  flight  control  systems  to  provide  better 
performing  and  more  efficient  military  or  civil  aircraft.  This  report  is  an 
introduction  to  fly-by-wire  control  system  design.  It  establishes  the  system 
requirements  and  design  criteria  for  fly-by-wire  control.  It  also  establishes 
the  types  of  components  available  today  and  the  combinations  that  are  best 
suited  for  mechanizing  such  systems. 

A  fly-by-wire  flight  control  system  is  an  electrical  primary  flight  control 
system  employing  feedback  such  that  vehicle  motion  is  the  controlled  para¬ 
meter.  No  Mechanical  backup  is  used.  Fly -by-wire  has  been  studied  and 
proposed  for  at  least  the  past  15  years,  often  under  the  title  "Electrical 
Flight  Control  Systems".  However,  past  research  has  nearly  always  been 
narrowly  aimed  at  one  or  two  specific  approaches  which  replaced  the  link 
between  the  control  stick  and  the  surface  and  ignored  the  handling 
quality  or  feel  requirements.  This  report  satisfies  a  need  for  a  more 
general  approach  to  the  subject. 

Although  mechanical  control  system  designs  have  improved  tremendously  through 
the  years  both  in  techniques  and  materials,  they  have  been  having  a  progres¬ 
sively  more  difficult  time  in  keeping  up  with  the  performance  gainB  and  con¬ 
trol  requirements  of  successive  generations  of  aircraft.  Most  designers  have 
agreed  that  fly-by-wire  could  solve  the  flight  control  problems  if  a  practical 
approach  could  only  be  mechanized.  The  problem  has  been  that  no  one  has 
satisfactorily  provided  a  practicable  and  reliable  fly-by-wire  Bystem  design 
that  could  be  produced  with  existing  hardware.  This  problem  has  several 
facets.  One  primary  factor  has  been  the  unavailability  of  components  having 
proven  reliability.  Another  factor  is  that  fly -by-wlre  design  is  a  multi¬ 
discipline  venture  that  encompasses  mechanical,  electrical,  and  hydraulic 
enginecilng.  Further,  the  application  of  redundancy  has  generally  not  been 
well  understood.  This  report  will  attempt  to  eliminate  these  factors  to  show 
how  a  practicable,  redundant  fly-by-wire  system  can  be  mechanized  using 
available  hardware. 

This  introduction  is  Section  I  of  this  report;  Section  TI  presents  the 
sources  of  data  included.  Section  III  provides  a  historical  perspective  of 
the  evolution  of  flight  control  systems  including  the  previous  and  related 
work  on  fly-by-wire  and  problems  involved.  Many  discussions  were  held  with 
pilots  and  engineers  in  the  aircraft  industry  to  uncover  problem  areas  in 
flight  control  systems  and  to  determine  their  attitudes  and  past  and  planned 
work  on  fly-by-wire.  Section  IV  discusses  fly -by-wire  control  in  general  and 
several  existing  systems  in  particular,  such  as  the  X-20  system,  and  several 
pseudo  fly-by-wire  systems  (having  mechanical  reversion)  such  as  the  F-lli.  A 
component  discussion  follows  in  Section  V  which  describes  available  and  pre¬ 
ferred  devices.  Section  VI  describes  the  system  design  criteria  and  trade¬ 
offs.  Candidate  systems  are  described  which  satisfy  the  design  criteria. 

The  results  of  simulation  studies  of  these  systems  are  described  in 
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Section  VII,  including  limited  breadboard  model  work.  In  Section  VIII,  the 
mechanical  control  systems  and  equivalent  fly-by-wire  systems  for  the  B-52, 
F-lll,  and  CH-U6  are  compared  to  show  the  relative  benefits  for  several 
different  classes  of  aircraft.  After  the  conclusions  and  recommendations, 
which  are  found  in  Section  IX,  a  glossary  of  terns  is  presented  in  Section  X 
that  establishes  a  much  needed  common  vocabulary. 
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SECTION  II 


SOURCES  OF  DATA 


1.  LITERATURE 

Because  of  the  relative  newness  of  the  art  of  fly-by-wire  design,  no 
single  preferred  source  of  data  is  available.  Therefore,  all  likely  infor¬ 
mation  sources  were  investigated  during  the  program  period  to  uncover  data 
on  past,  present,  and  planned  projects.  To  cover  as  many  sources  of  related 
work  as  possible,  both  a  literature  search  and  plant  visits  were  carried  out. 
The  literature  search  Included  an  Abstract  Bibliography  Request  from  the 
Defense  Documentation  Center  and  hand  searches  of  the  Technical  Abstract 
Bulletin,  Science  and  Technical  Aerospace  Reports,  International  Aerospace 
Abstracts,  The  Engineering  Index,  and  the  Applied  Science  and  Technology 
Index.  The  results  of  the  search  are  found  in  References  and  Bibliography, 
Section  XI,  at  the  end  of  the  report. 

2.  PLANT  VISITS 

Because  the  greater  share  of  work  relating  to  fly-by-wire  design  has 
never  found  its  way  into  the  literature,  pleuit  visits  were  made  to  various 
airframe  and  actuator  companies  to  determine  their  attitudes,  past  work,  or 
plans  (if  any)  involving  fly-by-wire  control.  The  following  companies  were 
visited  and  the  personnel  contacted  are  listed  as  follows: 

29  April  1966  Grumman  Aircraft  Company,  Bethpage,  New  York 

Mechanical  Systems  Section 
J.  Leonard 
J.  Morgan 
T.  Cosbey 
R.  Magner 

A.  Sammis 
H.  Shephard 

26  July  19 66  The  Boeing  Company,  Seattle,  Washington 

Control  Dynamics  Group 
D.  Bird 
R.  Hare 
R.  Hur low 
D.  Lewis 
H.  Toby 

28  July  1966  North  American  Aviation,  Los  Angeles,  California 

B-70  Division 
J.  Campbell 

B.  Palarz 

C.  Crother 
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26  July  19 66  Douglas  Aircraft  Company,  Long  Beach,  California 

Flight  Controls  Group 

V.  Sethre 

G.  Schlanert 

22  November  1966  General  Dynamics,  Fort  Worth,  Texas 

F-lll  Control  System  Group 

H.  Z.  Scott 

30  September  1966  Hydraulic  Research  and  Manufacturing  Company, 

Burbank,  California 

J.  Stuart 

D.  Wood 

G.  Jenny 

23  June  1966  National  Water  Lift  Company,  Kalamazoo,  Michigan 

Research  and  Development  Department 

C.  Hawk 

R.  Salemka 

V.  Heine 

1  November  1966  Weston  Hydraulics  Limited,  Van  Nuys,  California 

D.  Irwin 

3.  RELIABILITY:  THE  NUMBERS  GAME 

A  word  of  caution  on  reliability  data  is  in  order  at  this  point.  Anyone 
who  has  worked  with  reliability  enough  to  be  familiar  with  the  various  data 
sources  soon  realizes  that  reliability  may  degenerate  to  a  numbers  game  be¬ 
cause  of  unreliability  of  the  data.  This  is  particularly  true  for  non¬ 
electronic  component  data.  The  confidence  level  of  electronic  component  data 
can  be  made  tolerably  high  because  enough  life  test  time  can  be  accumulated 
on  very  large  numbers  of  parts  to  constitute  a  significant  sample.  A  readily 
available  source  for  such  data,  MIL-HDBK-217A  (Ref  l),  provides  an  acknow¬ 
ledged  common  reference  to  back  up  arguments.  Unfortunately  this  is  not  true 
for  nonelectronic  components.  Several  widely  quoted  references  (Ref  2,  3) 
exist  based  on  field  data  which  have  been  accumulated  in  an  attempt  to  bring 
some  order  out  of  chaos  in  this  area.  Because  of  the  lack  of  better  (or  any) 
data,  these  sources  are  too  often  quoted  Incorrectly  for  the  sake  of  quoting  a 
source,  with  the  hope  that  it  will  add  some  credence  to  the  argument  at  hand. 
For  example,  an  entry  in  reference  2  on  component  failure  rates  lists: 
"mechanical  assembly  A  *18.3  x  10 “6" .  This  value  came  from  the  linkages  and 
mechanisms  of  a  bombsight;  that  is,  a  mechanical  computing  mechanism. 

However,  this  number  has  been  applied  to  many  different  types  of  linkages 
ranging  from  a  single  actuator  mechanical  feedback  link  to  an  entire  flight 
control  system.  A  second  problem  exists  in  the  vide  range  of  values  which 
can  be  found  for  a  particular  component,  for  example,  an  electrohydraullc 
servovalve .  The  value  ranges  from  5  x  10”6  (Cadillac  Gage)  to  1.5  x  10~3 
(Ref  3)  •  Nothing  is  said  in  the  sources  about  the  type  of  valve,  its 
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application,  environment,  or  size.  Further,  the  data  are  for  valves  in 
service  years  before  the  source  publication,  and  the  valves  were  designed 
several  years  before  that.  Hence,  the  data  Is  anything  but  up  to  date.  The 
failure  rate  quoted  in  Avco  for  a  servo  amplifier  of  37  x  10“5  la  another 
misused  figure  since  it  refers  to  vacuum  tube  amplifiers  which  are  hard  to 
find  these  days  except  in  the  older  aircraft.  An  up-to-date  value  for  a 
transistor  amplifier  ranges  from  4  to  12  x  10**°  each  hour  depending  on  the 
design  and  application. 

The  point  of  this  discussion  is  that  data  cannot  be  meaningfully  quoted 
from  a  source  unless  the  source's  application,  environment,  component  type, 
etc  are  known,  and  the  quoter's  application,  environment,  component  type,  etc 
are  similar.  For  this  reason,  the  values  employed  in  this  report  are  not 
quoted  directly  from  any  one  source  except  for  the  electronics.  Rather,  a 
reasonable  estimate  has  been  made  based  on  all  known  source  data  plus 
unpublished  manufacturers '  data  where  it  Is  available.  If  the  reader  has 
access  to  better  data  with  an  acceptable  confidence  level,  he  should  make 
appropriate  corrections. 
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SECTION  III 

HISTORICAL  PERSPECTIVE  AND  PROBLEM  DISCUSSION 


1.  FLIGHT  CONTROL  SYSTEM  DEVELOPMENT 
a.  Control  Linkages 

In  early  days  flying  was  solo  In  small,  slow  airplanes.  Flying  has 
developed  over  the  past  60  years  until  today  aircraft  carry  upwards  of  200 
people  at  speeds  up  to  5  to  10  times  as  fast  as  ground  transportation .  De¬ 
signers  have  done  an  excellent  Job  of  providing  the  pilot  with  controls  that 
can  hsuidle  such  craft  when  necessary,  with  powered  assistance,  l.e.,  mechan¬ 
ical  reversion.  The  success  of  mechanical  controls  has  prompted  many  people 
in  the  field  to  believe  that  all  future  craft  should  be  so  controlled.  Our 
belief  Is  that  this  attitude  can  compromise  controls  design  such  that  flight 
safety  will  be  reduced  and  system  complexity  will  be  Increased  unduly. 

EJver  since  the  Wright  brothers  invented  hinged  control  surfaces, 
people  have  been  looking  for  ways  to  reduce  the  moment  required  to  move  them. 
Such  developments  include  the  adjustable  stabilizer  and  aerodynamic  balances . 
Fixed  balances  (such  as  offset  hinges,  horns,  overhangs,  etc)  soon  gave  way  to 
adjustable  devices  because  the  pilot  could  no  longer  cope  with  the  incre¬ 
mental  forces  on  the  larger  and  faster  aircraft.  Movable  surfaces  (l.e., 
tabs)  solved  this  problem  for  a  good  while,  but  they  in  turn  have  reached 
their  limit  in  effectiveness. 

Powered  controls  came  about  originally  as  part  of  the  autopilot.  A 
limited  authority  actuator  would  move  the  controls  for  the  pilot  to  maintain 
level  flight  thereby  lightening  his  work  loads.  With  progressive  increases 
in  aircraft  size  and  speed,  power  boost  became  necessary  to  fully  utilize  the 
available  maneuverability.  Fully  powered  controls  came  into  being  shortly 
after  World  War  II.  Such  controls  are  completely  irreversible  since  the 
pilot  is  no  longer  directly  connected  to  the  surfaces. 

When  power  assist  was  added  to  the  controls,  control  reversibility 
was  reduced  and  so  was  the  pilot's  control  feel.  Therefore,  feel  was 
augmented  artificially  with  springs  and  dashpots.  When  the  controls  became 
fully  powered,  all  feel  was  lost.  Therefore,  sill  of  the  pilot's  cues  had  to 
be  supplied  artificially.  While  it  is  true  that  artificial,  feel  is  not 
required  in  moving  the  control  surfaces,  it  is  required  to  give  the  pilot  the 
proper  handling  quality  characteristics  for  control  of  the  aircraft.  The 
artificial  feel  system  then  becomes  an  important  and  integral  part  of  the 
flight  control  system.  The  stability  augmentation  system  and  autopilot  must 
also  be  included  in  these  considerations  since  they  alter  the  banlc  dynamic 
and  static  stability  and  hence  the  handling  qualities  and  feel  characteristics 
of  the  aircraft.  This  subject  must  be  understood  before  adequate  approaches 
can  be  formulated. 

The  evolving  control  system  has  been  further  complicated  by  the 
addition  of  stability  augment ers  and  control  stick  steering.  The  latter  was 
added  to  reduce  the  effects  of  friction,  inertia,  and  nonlinearities  in  the 
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control  system.  The  simplified  control  system  shown  In  figure  1  depicts  the 
simple  reversible  system  which  Is  still  used  in  light  aircraft  today.  Here 
all  control  forces  are  reflected  bach  to  the  pilot's  hand.  This  Is  no  longer 
the  case  in  the  irreversible  fully-powered  system  shown  in  figure  2.  There¬ 
fore,  an  artificial  force  producer  must  be  added  as  previously  mentioned. 
Control  of  the  neutral  position  of  the  feel  system  as  It  changes  vith  flight 
condition  is  also  required.  This  is  a  trim  function  very  similar  to  the 
simple  system.  A  parallel  input  servo,  figure  5>  moves  the  control  stick 
along  with  the  pilot.  Such  a  servo  coon  only  provides  AFCS  (Automatic  Flight 
Control  System)  Inputs  so  that  the  pilot  can  observe  and  monitor  its  actions. 
The  series  input  servo,  figure  4,  adds  to  or  subtracts  from  the  pilot's 
inputs  so  that  no  control  stick  motion  occurs.  This  type  of  servo  is  com¬ 
monly  employed  for  stability  augmentation  signals  which  would  otherwise  cause 
considerable  high  frequency  activity  at  the  control  stick.  Such  motion  would 
be  very  annoying  to  the  pilot.  Figure  5  shows  another  technique  for  adding 
series  Inputs  which  results  in  a  lighter  control  system.  Figures  6  and  7 
show  two  types  of  control  stick  steering  mechanizations.  Hiese  schemes  are 
also  called  comnand  or  control  augmentation  systems.  Their  purpose  is  to 
improve  control  response  by  bypassing  control  system  friction,  inertia, 
deadzones,  etc,  and  any  other  troublesome  problem  that  the  particular  control 
system  might  present.  Such  systems  have  been  in  use  since  about  i960  when 
designers  finally  decided  that  perhaps  the  mechanical  control  system  could  no 
longer  cope  with  the  control  requirements  of  the  aircraft.  Control  stick 
steering  or  comnand  augmentation,  which  is  used  on  the  F-lll,  the  A-7A,  the 
supersonic  transport  (SST),  and  the  Jumbo  Jets  (i.e.,  the  C-5A  and  its  deriva¬ 
tives)  among  others,  is  the  forerunner  of  the  fly-by-wire  control  system  shown 
in  figure  8.  The  control  stick  steering  system  has  now  been  refined  to  the 
point  where  it  is  in  essence  a  fly-by-wire  control  system  with  mechanical 
reversion.  Hie  last  step  in  this  evolution  is  to  remove  the  backup  system. 

b.  Mechanical  Control  Systems  Problems 

Hie  relatively  simple  direct  linkages,  cables,  and  feel  springs  for 
muniiftl  control  described  cannot  meet  the  greater  demands  of  advanced 
aircraft  control  system  design  requirements.  Simple  manual  control  systems 
have  been  replaced  by  complex  nonlinear  linkages,  mixing  assemblies,  power 
actuation  devices,  and  active  artificial  feel  systems.  These  complex  manual 
control  systems  have  increased  requirements  for  space  and  weight  in  aircraft 
where  both  are  at  a  premium.  Nonlinearities  such  as  deadband,  hysteresis, 
and  backlash  result  from  the  increased  compliance,  inertia,  and  friction  of 
complex  mechanical  devices.  These  nonlinear  it  ies  degrade  the  performance  of 
the  control  system,  and  as  a  result,  the  full  capabilities  of  the  aircraft 
are  not  realized.  Additional  control  problems  also  result  from  temperature 
variations  and  airframe  flexibility.  Now  that  full-time,  full-power  stability 
or  comnand  augmentation  systems  (SAS  or  CAS)  have  arrived,  the  mechanical 
system  is  used  only  in  the  event  of  a  CAS  failure.  In  certain  aircraft,  the 
mechanical  system  may  not  even  provide  survival  capability  because  of  inherent 
aircraft  instabilities  at  some  flight  conditions.  For  safety  and  mission 
reliability,  therefore,  the  augmentation  system  must  be  as  reliable  as  the 
mechanical  control  system.  Thus,  the  mechanical  control  system  imposes  a 
weight  and  space  penalty  at  certain  flight  conditions  where  it  provides  no 
usable  function.  Hie  solution  to  these  problems  is  to  replace  the  mechanical 
control  system  with  a  fly -by-wire  By  stem. 
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Figure  2 

Fully  Powered  ( Irreversible)  Control  System 
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Series  Input  Servo 
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Hie  complexity  of  modern  control  systems  is  readily  apparent  in 
figure  9  which  presents  a  slightly  simplified  diagram  of  the  F-lll  mechani¬ 
cal  pitch  and  roll  flight  control  system.  This  system  is  a  backup  to  a 
primary  electrical  flight  control  system  which  is  Itself  a  fly-by -wire  system. 
General  Dynamics  recognized  the  potential  difficulties  of  the  mechanical 
system  when  they  relegated  It  to  a  stardby  role,  Hie  following  discussion 
will  set  forth  the  most  notable  problem  areas  that  occur  In  mechanical  sys¬ 
tems  along  with  some  case  histories.  The  application  of  fly-by-wire  to 
eliminate  these  problems  is  obvious  in  most  cases. 


Hie  controls  designer  must  consider  a  large  number  of  characteristics 
and  factors  in  establishing  a  flight  control  system  design.  Some  of  these 
characteristics  are  required  by  the  system.  These  typically  include: 


11)  Nominal  travel 
2)  Operating  loads 
3)  Maximal  velocity 
4)  Frequency  response 
5)  Sensitivity 


(6)  Minimal  increment  of  control 

(7)  Positioning  accuracy 

(8)  Synchronization  accuracy 

(9)  Stability 

(10)  Life 


A  number  of  negative  characteristics  also  exist  that  tend  to  prevent  the 
designer  from  attaining  his  design  goals.  These  typically  Include: 


Friction 

Temperature  change 

Deadbands 

Hysteresis 

Backlash 

Complexity 


7)  Inertia 

8 )  Compliance 
(9)  Body  bending 

(10)  Routing 

(11)  Weight 

(12)  Volume 


The  order  of  importance  depends  on  the  particular  aircraft  and  does  not  neces¬ 
sarily  follow  the  above  order.  Hie  significance  of  most  of  these  problem 
factors  grows  along  with  the  size  of  the  airplane.  For  example,  small  fixed- 
wing  fighter/attack  aircraft  such  as  the  F-5  and  A-6a  have  relatively  few 
problems.  Such  aircraft  in  general  would  not  benefit  appreciably  from  the 
application  of  fly-by-wire  except  to  reduce  control  inertia,  weight,  and 
volume.  On  the  other  hand,  although  all  present  VTOL  designs  are  relatively 
small,  they  would  benefit  appreciably  from  fly -by -wire  because  of  the  re¬ 
duction  in  weight  and  complexity.  Fly -by -wire  would  typically  reduce  VTOL 
weight  by  several  hundred  pounds  and  In  some  cases  provide  control  designs 
that  are  virtually  Impossible  to  obtain  mechanically.^ 

Friction  Is  one  of  the  biggest  bugaboos  of  the  control  designer.  Low 
system  friction  Is  essential  to  ensure  that  an  otherwise  excellent  airplane 
is  not  made  unacceptable  from  a  handling  qualities  point  of  view.  Excessive 
friction  msusks  the  control  feel  characteristics;  this  is  particularly  critical 
around  neutral  or  trim  position.  Excessive  control  breakout  forces  due  to 
friction  la  particularly  damaging  to  proper  control  feel.  To  provide  positive 
centering,  a  preload  force  larger  than  the  friction  force  is  required.  Pre¬ 
loads  over  1-1/2  pounds  are  excessive  since  they  produce  a  notch  effect  and 
make  simple  tracking  tasks  very  difficult.  In  very  large  aircraft  such  as 
the  C-5A,  the  breakout  friction  can  be  so  high  that  it  exceeds  the  average 
pilot* 8  capability  to  even  move  the  controls.  Hie  SST  will  be  nearly  as  bad. 
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Estimates  of  performance  on  the  mechanical  system  alone  show  that  ±1  g  accel¬ 
eration  overshoots  are  extremely  likely.  The  cocmon  solution  to  these  prob¬ 
lems  is  to  add  a  small  parallel  boost  actuator  to  help  the  pilot  overcome  the 
friction.  Stick  force  transducers  are  now  also  required  to  control  the  boost 
actuator.  The  actuator  force  output  is  limited  to  Just  below  the  friction 
level  so  that  a  small  additional  force  applied  by  the  pilot  moves  the  controls. 
Friction  causes  control  system  hysteresis  vhich  significantly  affects  how 
closely  the  system  returns  to  the  trim  position  once  it  has  been  displaced.  If 
the  pilot  trims  his  stick  forces  for  a  particular  trim  speed,  the  hysteresis 
could  allow  the  speed  to  change  significantly  before  an  effect  is  felt  at  the 
stick. 


Any  moving  component  in  the  control  system  adds  friction.  This 
includes  bearings,  cable  systems,  hydraulic  servovalves,  cockpit  pressure 
seals,  cartridge  preload  springs,  fairleads  and  antibacklash  springs.  By 
actual  count,  the  F-lll  system  shown  in  figure  9  contains  llU  bearings,  2 
servovalves,  2  cockpit  pressure  seals  and  3  feel  springs.  The  factor  that 
saves  this  system  is  the  unique  bearing  used  that  is  self -lubricating  and 
has  an  extremely  low  friction  level .  Cockpit  pressure  seals  presented  a 
large  problem  in  at  least  one  transport  aircraft  when  over  a  period  of  time 
tobacco  tars  accumulated  in  the  seal  lubricant  and  caused  a  dangerously  high 
friction  level.  Cable  system  friction  is  usually  higher  thai.  pushrod  system 
friction.  It  depends  on  the  number  of  pulleys  and  quadrants,  travel,  and  the 
rigging  load.  Tension  regulators  are  required  to  maintain  the  desired  tension 
load  to  minimize  friction. 

Temperature  changes  also  cause  friction  because  of  unequal  expansion 
between  the  airframe,  which  is  aluminum,  and  the  control  system,  which  is 
basically  steel.  In  aircraft  traveling  below  Mach  2,  the  temperature  change 
is  due  to  altitude .  The  temperature  differential  ranges  from  over  +120*F 
(+48.9*C)  on  the  ground  to  -85*F  (-65*C)  at  high  altitudes.  The  Martin 
Seamaster,  for  example,  could  not  fly  higher  than  25,000  feet  because  unequal 
expansion  would  lock  the  control  system.  At  one  time  the  Convair  880  had  a 
dual  cable  consisting  of  an  aluminum  tubing  over  a  spring.  This  system  would 
also  lock  up  at  high  altitudes.  Aircraft  flying  at  Mach  3  or  higher,  such  aB 
the  B-70,  A- 11,  and  SST  have  a  different  temperature  problem  because  of  aero¬ 
dynamic  heating.  At  Mach  3  the  skin  temperature  of  the  aircraft  rises  to  over 
500*F  (260*C).  Typically,  the  fuselage  of  the  SST  and  B-70  grows  12  inches  at 
sustained  Mach  3  speeds. 

Temperature  and  moisture  combine  to  cause  icing  which  can  affect  the 
q-springs  used  in  artificial  feel  systems.  Moisture  enters  the  pressure  vents 
and  freezes  on  the  bellows  to  lock  the  spring.  The  effects  vary  with  the 
system  ranging  from  locked  controls  to  soft,  spongy  controls. 

Backlash  and  deadbands  ar  very  similar;  backlash  is  free  play  and 
deadbands  are  thresholds  such  as  preload.  Backlash  is  the  more  coranon 
problem  because  it  normally  results  from  wear  at  bearings  and  Joints.  Back¬ 
lash  in  the  B-47  reportedly  has  been  as  large  as  l/2  inch  after  a  year  of 
flying.  Backlash  effects  range  from  sloppy  and  unsatisfactory  control 
characteristics  to  PIO  (pilot  induced  oscillations). 

Complexity  means  an  Increase  in  the  number  of  individual  components 
in  the  control  system.  This  increases  cost,  weight,  volume,  failure  rate, 
spare  parts,  and  mintenance .  Control  system  complexity  is  primarily  caused 
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by  the  greater  performance  requirements  of  modern  flight  control  systems. 
Another  cause  of  complexity  is  the  very  inefficient  design  practice  of 
stuffing  the  control  system  into  whatever  space  is  left  after  all  of  the  other 
subsystems  are  in  the  airplane.  As  the  C-5A  and  SST  designers  have  no  doubt 
discovered,  control  system  redundancy  is  yet  another  cause  that  has  signifi¬ 
cant  cost,  weight,  and  space  penalties  for  a  mechanical  system.  Until  now  the 
mechanical  systems  have  been  low  performance  and  easy  to  maintain,  but  this  is 
no  longer  true  in  the  never  aircraft. 

Control  complexity  has  a  very  decided  effect  on  weight  and  design 
tractability  in  VTOL  aircraft  as  mentioned  earlier  in  this  discussion.  The 
thrust  vector  hover  control  for  lift  fan  systems  is  a  particularly  complex 
end  difficult  mechanical  design  problem.  The  mixing  mechanism  in  tilt-wing 
or  engine  designs  used  for  transition  from  hover  to  cruise  is  large,  heavy, 
and  also  complex.  These  two  areas  are  prime  candidates  for  early  application 
of  fly-by -wire  techniques.  Weight  savings  are  particularly  important  in  VTOL 
aircraft  because  it  improves  the  all-important  pover-to-veight  ratio. 

The  complexity  of  the  swing  wing  used  on  the  F-1.11  and  the  Boeing  SST 
causes  a  particularly  difficult  design  problem  for  the  lateral  control  system. 
The  variable  wing  sweep  oeche  lization  requires  a  variable  attachment  point 
for  the  spoiler  control  system  linkage  which  consequently  becomes  a  messy 
design  problem.  General  Dynamics  chose  to  solve  this  problem  on  the  F-lll  by 
employing  fly-by-wire  techniques.  No  system  failures  or  unusual  problems 
have  occurred  as  of  this  date  with  over  2,000  flight  hours  being  logged. 

Control  cable  routing  in  the  B-70  presented  some  difficult  problems 
because  of  the  long  runs,  limited  space,  and  friction  effects,  Hie  throttle 
system  could  not  operate  with  the  deadbands,  hysteresis,  and  backlash  inherent 
in  a  mechanical  cable  system.  The  acceptable  solution  was  to  use  fly-by-wire 
control.  The  flight  control  system  was  not  allowed  to  go  fly-by -wire  (which 
seems  inconsistent)  although  the  cable  routing  problems  were  considerable. 

The  presence  of  the  fuel  cells  in  the  fuselage  complicated  the  routing 
problem.  AH  available  routes  either  involved  going  outside  of  the  airframe  or 
using  an  excessively  large  number  of  direction  changes  which  would  result  in 
intolerable  friction  and  backlash.  Hie  solution  was  to  use  straight  runs 
down  the  fuselage  through  the  fuel  cells.  Special  seals  were  provided  to 
allow  this  path  to  be  used.  The  expense  and  problems  of  going  this  route  are 
obvious . 

Another  problem  involving  control  routing  and  fuel  cells  occurred  in 
the  A-6a.  The  elevator  and  rudder  control  rods  in  this  airplane  are  routed 
along  the  top  of  the  fuselage  between  the  aft  fuel  cell  and  the  airframe .  On 
occasion  the  fuel  cell  vent  would  stick  while  the  aircraft  was  climbing.  The 
trapped  air  would  expand  the  cell  enough  to  trap  the  control  linkages  against 
the  airframe  thus  locking  the  controls.  Usually  the  vent  would  open  in  a 
short  time  to  restore  normal  control,  but  all  pilots  were  not  so  lucky.  Some 
had  to  leave  their  airplanes. 
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Control  compliance  and  body  bending  (which  is  airfiame  compliance) 
cause  similar  problems,  namely,  deformation  of  the  con  vol  system  and/or 
the  airframe  when  loads  are  applied.  The  effect  is  that  of  adding  a  spring 
Inside  the  control  loop  which  is  destabilizing.  The  added  phase  lag  com¬ 
monly  reduces  system  performance,  but  it  sometimes  causes  PIO.  A  much  more 
severe  effect  occurs  when  control  system  and  airframe  vibrational  modes  couple 
into  each  other.  The  modes  then  reinforce  each  other,  causing  overstress  or 
fatigue  in  the  airframe.  This  can  either  destroy  the  airplane  or  reduce  its 
life  considerably. 

The  solution  to  these  problems  is  to  replace  the  mechanical  control 
system  with  fly-by-wire  control.  This  presents  a  new  set  of  problems  in 
designing  practical  fly-by-wire  systems  within  the  present  state  of  the  art 
in  controls  design  and  components.  The  new  problems  are  easier  to  solve, 
however,  as  is  discussed  in  later  sections  of  this  report. 

c .  Artificial  Feel 

Artificial  feel  is  a  very  important  and  integral  part  of  the  flight 
control  system.  In  any  control  system  design  problem,  the  designer  is  given 
a  relatively  fixed  plant  (the  aircraft  in  this  case)  for  which  he  must  design 
a  controller  (flight  control  system)  that  will  cause  the  plant  to  behave  in  a 
desired  manner  for  specified  Inputs  (the  desired  flight  maneuvers).  The  con¬ 
troller  for  a  manned  aircraft  actually  includes  the  pilot,  but  the  controls 
designer  cannot  do  much  about  the  design  of  the  pilot  any  more  than  he  can  do 
anything  about  the  design  of  the  aircraft  (often  to  his  chagrin).  But  he  can 
do  a  great  deal  about  the  design  of  the  flight  control  system  which,  sln^e  it 
primarily  concerns  artificial  feel  for  the  pilot,  will  be  referred  to  as  the 
artificial  feel  system. 

Ah  extensive  treatment  of  artificial  feel  is  beyond  the  scope  of  this 
report.  Therefore,  the  following  discussion  will  be  of  an  introductory  nature 
only.  For  a  more  detailed  discussion,  see  references  (4),  (5),  (6),  (7), 

(8)  and  (9)>  To  begin  the  discussion  of  artificial  feel  systems  and  its 
philosophies,  it  would  be  worthwhile  to  clarify  the  reason  for  using  artifi¬ 
cial  feel.  The  trend  toward  powered  controls  classically  has  been  con¬ 
sidered  to  be  the  result  of  the  high  aerodynamic  hinge  moments  associated 
with  higher  performance  aircraft.  This  is  not  the  principal  reason  for  the 
use  of  powered  controls.  As  the  aircraft  approaches  the  Bpeed  of  sound,  the 
aerodynamic  characteristics  of  the  vehicle  change  quite  rapidly,  and  as  the 
operational  speeds  move  on  into  the  supersonic  region,  the  characteristics 
settle  down  to  entirely  different  values  than  those  for  subsonic.  This  change 
is  due  to  the  aft  hovement  of  the  center  of  pressure  which  at  sonic  velocities 
moves  around  in  an  irregular  manner.  The  net  result  is  that  the  stick  forces 
are  highly  nonlinear  and  discontinuous  in  nature,  both  of  which  are  un¬ 
acceptable  in  terms  of  proper  vehicle  handling  qualities.  Accordingly,  it 
has  been  in  the  best  interest  to  divorce  the  stick  forces  entirely  from  the 
aerodynamic  hinge  moment  forces,  hence  the  birth  of  irreversible  control  sys¬ 
tems  and  artificial  feel.  The  use  of  irreversible  control  systems,  therefore, 
is  not  because  of  the  large  hinge  moments,  but  rather  due  to  the  deterioration 
of  the  stick  forces  and  handling  qualities  near  and  above  the  sonic  barrier. 
Artificial  feel  is  then  used  to  provide  the  proper  handling  characteristics 
to  the  pilot.  With  such  a  system,  the  pilot  is  completely  Isolated  from  the 
aerodynamic  farces  acting  on  the  control  surface.  In  the  exact  sense,  a 


fly -by -wire  system  Is  an  irreversible  system  in  which  the  method  of  trans¬ 
mitting  the  control  signal  is  nonmechanical. 

The  artificial  feel  system  has  three  purposes.  First,  it  must  provide 
the  proper  force  and  position  cues  to  allow  the  pilot  to  obtain  near  optimum 
maneuver  and  path  control.  Second,  it  must  aid  in  preventing  inadvertent 
overstressing  of  the  ai:*frame.  Third,  the  control  motions  under  hands-off 
flight  must  result  in  satisfactory  dynamic  aircraft  stability.  The  third 
requirement  is  satisfied  by  the  stability  augmentation  subsystem.  The  first 
requirement  is  further  subdivided  into  three  areas:  first,  feel  resulting 
from  a  change  in  airspeed  from  the  original  equilibrium  speed  which  is  given 
by  the  gradient  of  stick  force  per  change  in  airspeed;  second,  feel  resulting 
from  normal  acceleration  during  a  steady-state  maneuver  which  is  given  by  the 
stick  force  required -for  a  given  acceleration;  and  third,  the  feel  resulting 
from  normal  acceleration  during  a  transient  maneuver  also  given  by  the  ratio 
of  stick  for  per  incremental  acceleration. 

Although  the  requirement  for  artificial  feel  has  been  firmly  estab¬ 
lished,  two  separate  philosophies  exist  on  the  manner  in  which  characteristics 
should  be  obtained.  One  states  that  the  artificial  feel  should  duplicate  the 
forces  of  the  reversible  control  system  since  this  is  the  framework  around 
which  all  flying  qualities  have  been  tailored.  In  this  scheme,  the  artificial 
feel  varies  the  force  gradient  on  the  control  stick  as  a  function  of  flight 
condition,  but  it  does  not  vary  the  aircraft  characteristics.  Hie  other 
philosophy  states  that  the  forces  of  the  reversible  system  need  not  be  dupli¬ 
cated  to  provide  the  best  handling  qualities.  In  this  method,  the  feel  system 
fixes  the  control  stick  force  gradient  but  varies  the  aircraft  characteristics 
to  change  the  response  to  commands  as  a  function  of  flight  conditions.  Both 
methods  use  controllers  to  modify  the  pilot's  inputs  to  the  surface  actuators 
so  as  to  compensate  for  the  aircraft's  dynamic  performance  variation  with 
flight  condition.  The  first  method  generally  uses  open-loop  control  tech¬ 
niques.  It  measures  the  environment  and/or  flight  condition  (e.g.,  dynamic 
pressure  or  trim)  and  then  uses  these  parameters  to  vary  the  control  stick 
force  gradient.  The  ratio  of  surface  deflection  to  stick  displacement 
remains  constant.  The  success  of  this  method  depends  on  how  well  the  variable 
force  gradients  match  the  desired  gradients  over  the  flight  regime.  For 
subsonic  flight  the  open  loop  method  can  match  the  gradients  satisfactorily. 
For  transonic  flight  the  match  becomes  much  more  difficult  to  obtain;  conse¬ 
quently,  the  feel  system  generally  requires  a  considerable  degree  of  fcompen- 
sation  and  becomes  complex. 

Hie  second  method  useB  closed-loop  control  techniques  since  it  feeds 
back  the  aircraft  response  (rate  and  acceleration)  for  simulation  with  the 
conmand  Inputs.  The  controller  consists  of  a  fixed  spring  force  gradient 
and  model  filter  for  shaping  the  conmand  inputs.  At  this  point  the  system 
sums  the  shaped  conmand b  with  the  aircraft  rate  and  acceleration  feedback  to 
form  what  is  basically  an  acceleration  Command  system.  Since  specific  surface 
positions  are  not  commanded,  the  ratio  of  surface  deflection  to  stick  dis¬ 
placement  varies  with  flight  condition.  Using  the  aircraft  as  an  element  in 
the  forward  path  of  a  closed  loop  reduces  the  effects  of  its  varying  response 
characteristics.  Using  this  basic  advantage  of  a  closed-loop  servo,  the  sys¬ 
tem  achieves  a  nearly  constant  acceleration  response  for  a  given  stick 
displacement.  In  other  words,  it  achieves  a  nearly  constant  stick  force  per 
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unit  acceleration  regardless  of  the  flight  condition.  The  gradient  can  be 
readily  tailored  electronically  to  suit  the  pilot  by  changing  the  model  or 
the  servo  gradient. 

The  closed-loop  method  should  be  used  for  artificial  feel  in  fly-by- 
wire  systems  for  several  reasons.  First,  it  eliminates  the  reliance  on  air 
data  computation  which  is  notoriously  unreliable.  Further,  it  replaces  heavy 
q-springs  and/or  bobweights  with  rate  gyros  and  accelerometers  which  quite 
often  already  exist  in  the  airplane  for  use  by  the  AFCS  or  SAS.  In  addition, 
since  the  system  provides  feel  charact eristics  that  are  nearly  independent  of 
the  airframe,  the  feel  of  pH  aircraft  within  a  class  (e.g.,  fighters  or 
bombers)  can  be  standardized. 

Factors  in  implementing  an  artificial  feel  system  include  friction, 
backlash,  location  of  the  column  or  stick  and  its  displacement,  vhether  series 
or  parallel  trim  is  used,  airframe  deflections,  visibility,  end  the  harmony 
between  axes.  They  all  have  a  bearing  on  how  the  system  feels  and  performs. 
The  complexity  also  depends  on  the  particular  axis.  Because  the  pilot's  feet 
are  relatively  insensitive  to  reaction  forces,  simple  springs  on  the  rudder 
pedals  provide  adequate  feel  for  the  yaw  axis.  Lateral  axis  control  is  much 
more  sensitive  so  that  spring  forces  are  kept  low  and,  consequently,  so  are 
friction  and  inertia.  Again  simple  springs  are  usually  adequate.  The  major 
problem  occurs  in  the  longitudinal  axis.  Therefore,  the  following  discussion 
will  be  limited  to  that  axis  for  a  fixed-wing  aircraft. 

Basically,  the  control  feel  for  a  fixed-wing  aircraft  is  measured  by 
the  response  of  the  vehicle  to  a  control  conmand.  The  pilot  can  measure  this 
response  by  a  "feel"  presented  to  him  by  the  control  stick,  the  acceleration 
forces  on  his  body,  and  his  visual  attitude  cues.  The  control  stick  feel  will 
be  provided  by  the  force  which  he  has  to  exert  upon  the  stick  and  by  the  posi¬ 
tion  of  the  stick  relative  to  a  straight  and  level  trimmed  position.  In  re¬ 
viewing  various  authorities  on  pilot  performance,  they  conmonly  agree  that  a 
pilot  controls  a  conventional  fixed-wing  aircraft  primarily  by  force. 

Position  information  also  contributes,  but  it  has  a  smaller  influence. 

For  a  given  applied  elevator  Btick  force,  the  pilot  would  like  the 
corresponding  steady-state  normal  acceleration  as  illustrated  by  figures  10 
and  11.  Several  basic  requirements  are  illustrated  by  these  figures.  The 
pilot  requires  that  the  control  stick  have  positive  centering;  this  allows 
him  to  trim  the  vehicle  to  a  reference  flight  orientation  and  stay  in  trim. 

It  also  reduces  the  possibility  of  inadvertent  inputs  and  cross  coupling. 

Once  he  has  broken  out  of  the  positive  centering  area,  the  pilot  would  like  a 
near  linear  relationship  between  incremental  stick  force  and  resulting  normal 
acceleration.  However,  a  means  of  limiting  acceleration  is  required  to  pre¬ 
vent  the  pilot  from  over-controlling  and  causing  structural  damage  to  the 
vehicle . 


The  steady-state  stick  force  gradient  requirement  for  various  opera¬ 
tional  altitudes  is  illustrated  by  figure  11.  This  constraint  provides  the 
pilot  with  a  vehicle  with  constant  response  characteristics  to  a  fixed  force 
command,  regardless  of  airspeed. 
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Figure  11 

Constant  Stick  Force  Gradient 


The  longitudinal  stick  forces  and  control  feel,  defined  by  figures  10 
and  11  represent  the  requirements  for  a  steady-state  maneuver.  In  addition, 
for-  a  given  maneuver,  the  stick  forces  should  be  higher  for  a  rapidly  applied 
conmand  than  for  a  slowly  applied  one  as  shown  In  figure  12.  This  factor 
provides  an  additional  feel  Indication  of  the  acceleration  magnitude  of  the 
c demanded  maneuver.  If  this  characteristic  were  not  provided,  the  structural 
limit  load  factor  could  be  exceeded. 

The  following  discussion  looks  at  the  factors  that  govern  the 
selection  of  a  more  complex  artificial  feel  system  over  a  simple  spring. 

As  a  simple  model,  consider  the  system  as  Illustrated  In  figure  13*  This 
system  is  an  Irreversible  pitch  control  system  for  a  conventional  fixed-wing 
aircraft  using  a  linear  spring  for  artificial  feel.  The  spring  displacement, 
stick  force,  and  elevator  position  can  be  approximated  by  the  following 
relationships 


fb  -  +kib 

iB  -  K^e 
Fb  "  +Ko*e 

Kq  -  +KXK  (1) 


where  K  represents  the  linear  spring  gradient;  Ki  is  the  static  gain  between 
the  stick  position  and  the  elevator  surface. 

Since  the  handling  qualities  of  the  pitch  axis  are  generally  refer¬ 
enced  to  the  steady-state  normal  acceleration,  we  need  the  normal  acceleration 
(steady- state)  characteristic  to  a  step  elevator  conmand.  Of  the  various 
methods  available  for  approximating  the  normal  acceleration  term,  the 
simplest  Is  to  evaluate  the  steady-state  response  of  the  system  transfer 
equation.  Equation  (2)  presents  the  simplified  transfer  equation  relating 
the  normal  acceleration  characteristics  to  the  elevator  conmand. 
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The  steady-state  response  to  a  step  elevator  conmand  may  be  defined  by, 
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Figure  12 

Aircraft  Response  to  Slow  and  Fast  Inputs 
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Figure  13 
Irreversible  Control  System 
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aerodynamic  characteristics  and  making  the  assumption  that  M  Z  «u  M  , 
this  expression  takes  the  form:  ^  w  °  w 


The  stability  derivative  may  be  further  expanded. 

a 

Cm  -  (XCG  -  N0)  cz  (5) 
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Introducing  this  relationship  back  into  equation  (4)  reduces  it  to 
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Since  the  data  available  is  generally  In  the  form  of  the  dimensional  deri¬ 
vatives,  it  is  necessary  to  rewrite  equation  (6)  in  the  following  form: 
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The  expression  (x^q  -  N0)c  defines,  in  feet,  the  difference  in  the  location 
of  the  vehicle  center  of  gravity  and  stick  fixed  neutral  point  and  Iyy/m  is 
required  for  dimensional  correctness.  Equations  (l)  and  (T)  may  now  be  used 
as  a  basis  for  discussing  the  handling  characteristics  of  an  irreversible 
control  system  having  a  simple  spring  for  artificial  feel. 


As  established  in  the  previous  section,  the  feel  requirement  is  for 
a  constant  stick  force  per  increment  in  normal  acceleration.  Introducing 
equation  (l)  into  equation  (7)  defines  an  expression  for  our  control  system. 


•e  «C  (Xro  -  N0) 


(8) 


Examination  of  the  above  equation  discloses  that  at  a  specific  altitude, 
speed,  and  center  of  gravity  position,  the  artificial  feel  spring  constant 
may  be  selected  to  provide  the  required  stick  force/g  characteristic  F/n 
where  n  =  (nz/g).  However,  for  a  fixed  spring  constant  Fs/n  will  be  a 
variable:  a  function  of  vehicle  aerodynamics  and  the  static  margin.  As  an 
illustration  of  this  point,  data  were  gathered  on  the  Lockheed  SST  using  the 
above  equations.  For  a  given  flight  condition  and  static  margin,  a  spring 
constant  K  was  selected  which  provided  60  lb/g  response  characteristic.  This 


2k 


reference  system  vas  then  perturbed  by  holding  the  static  margin  constant  and 
changing  the  airspeed  by  ±15  percent.  The  results  are  illustrated  by  the 
dashed  lines  in  figure  14.  Next,  the  airspeed  vas  held  constant  and  the 
center  of  gravity  allowed  to  deviate  from  the  reference  position  by  ±10  per¬ 
cent.  These  results  are  defined  by  the  phantom  lines.  Reviewing  figure  lU 
and  its  characteristic  equation  (8),  it  is  evident  that  a  simple  spring  arti¬ 
ficial  feel  system  is  inadequate.  The  deficiency,  as  illustrated,  is  due  to 
the  changing  aerodynamics  and  center  of  gravity  movement.  Therefore,  a  simple 
linear  spring  vill  not  meet  the  feel  requirements.  However,  if  the  spring 
were  augmented  by  parameters  which  are  related  to  the  change  in  the  aero¬ 
dynamics  and  center  of  gravity  location,  the  resulting  artificial  feel  system 
would  be  adequate. 

Hie  approach  shown  in  figure  15  utilizes  a  q-apring  and  stabilizer 
trim  position  to  control  the  feel  characteristics.  We  would  like  the  stick 
forces  to  be  proportional  to  the  dynamic  pressure  q  and  surface  deflection; 
that  is, 


F.ssq.  (9) 
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which  together  with  the  control  surface  to  sticK  gearing  from  equation  (l) 
becomes 


F,  -  Kxq sb  (10) 

where  the  original  K  in  equation  (l)  becomes  now  K^q.  This  method  of 
artificial  feel  is  known  in  the  trade  as  q  feel  or  Kq#  feel.  The  variation 
of  q  with  velocity,  shown  in  figure  l6  is  nearly  linear  up  to  about  Mach 
0.7. 


A  typical  q-spring  produces  a  force  gradient  proportional  to  the 
pressure  differential  across  the  diaphragm  of  a  bellows.  This  assumes  that 
the  bellows  acts  as  a  zero-rate  spring  or  a  perfectly  extensible  membrane. 

The  pressure  differential  p^  -  p„,  where  is  the  total  pressure  and  pB  is 
the  static  pressure  as  measured  by  a  pitot  tube,  can  be  expressed  in  terms  of 
the  dynamic  pressure. 

q  *  Pt  -  PB  “  1/2HJ2  ■  0.7Pb  M2 

2 

q  ■  dynamic  pressure  lb/ft 
#  ■  ambient  air  density  slugs/ft^ 

U  *  true  airspeed  ft /sec 
M  *  Mach  number 

Then  F  »  K(pt  -  p8)  #s  -  Kq#B  -  0.7PS  KM2  #B. 

Figure  17  shows  the  typical  control  feel  responses  that  can  be 
expected  versus  Mach  number.  The  q-spring  improves  the  FB/n  characteristics 
for  subsonic  Mach  numbers.  However,  for  transonic  and  supersonic  Mach 
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V  *  LOCAL  VELOaTY  (FT/SEC) 


Figure  17 

Stick  Force  For  Each  Steady-State  Acceleration,  Lockheed  SST 


numbers,  Fs  is  too  high  not  only  because  of  the  higher  q  but  because  of  the 
lower  normal  acceleration  response  of  the  aircraft  with  increasing  Mach  number 
as  shown  in  figure  18.  The  Fg/n  for  supersonic  Mach  numbers  can  he  reduced 
to  a  tolerable  level  by  compensating  the  bellows  with  springs  or  air  bleed 
devices,  but  this  adds  undesirable  complexity.  A  small  electromechanical 
actuator  varies  the  neutral  position  of  the  q-spring  according  to  the  trim 
condition.  This  accounts  for  center  of  gravity  and  static  margin  variations 
and  relieves  the  steady-state  stick  forces. 

Other  popular  artificial  feel  producers  include  single  and  double 
bobweight6  which  produce  forces  in  response  to  aircraft  motion.  The  bobweight 
amounts  to  a  lead  weight  cantilevered  off  the  stick  or  its  associated  linkage. 
The  spring  plus  bobweights  system  produces  forces  proportional  to  stick  de¬ 
flection  and  normal  and  angular  acceleration.  The  mechanization  is  simple  and 
reliable,  but  it  is  heavy  and  adds  control  inertia. 

No  one  has  ever  designed  an  optimum  artificial  feel  mechanization,  and 
no  one  ever  will  until  a  standard  handling  qualities  criterion  has  been 
established.  The  feel  mechanizations  employed  thus  far  in  history  have  been 
the  result  of  series  of  compromises  of  acceptable  handling  qualities  against 
the  various  mechanization  designs  and  problems.  The  situation  will  be  no 
different  for  fly-by-wlre  systems  except  that  the  mechanization  problems  will 
be  much  smaller  due  to  the  increased  design  flexibility.  One  of  the  goals  of 
fly -by-wire  design  is  to  reduce  system  weight  and  volume.  Therefore, 
mechanizations  using  q-springs  and  bobweights  are  to  be  avoided. 

The  closed-loop  method  of  implementing  feel  has  considerable  merit 
from  many  aspects  including  weight,  space,  performance,  and  its  ready  integra¬ 
tion  with  the  SAS,  CAS,  or  AFCS  for  economy  of  utilization.  This  method 
utilizes  ->  feedback  blend  of  normal  acceleration,  pitch  rate,  and  pitch  ac- 
celeratic.i  because  these  are  the  dynamic  response  cues  that  the  pilot  senses. 
Experience  has  6hown  that  a  pilot  attaches  less  importance  to  •  as  velocity 
increases  since,  for  a  given  nz  transient,  both  the  peak  and  steady-state 
value  of  •  are  reduced.  Conversely,  at  low  velocities  as  in  the  approach 
condition,  the  #  cue  is  more  important  than  nz.  Although  the  blend  is  not 
entirely  new,  it  has  been  defined  by  Boeing  personnel  as  C*  (pronounced 
"C  star" )  =  nz  +  Kg  •  +  Kq  •  .  C*  can  be  represented  by  a  signal  con¬ 
sisting  of  a  blend  of  the  outputs  of  a  pitch  rate  gyro  and  a  normal  ac¬ 
celerometer  mounted  at  the  pilot's  station.  The  outputs  of  the  two  sensors 
are  combined  in  a  fixed  ratio.  The  relative  contributions  of  each  term 
automatically  vary  with  velocity  due  to  the  inherent  characteristics  of  the 
nz/#e  and  */le  transfer  functions.  The  steady-state  relationship  between 
nz  and  •  in  any  aircraft  is 


/  radians \  nz  ) 

V  sec  f  u  (ft/sec ) 


The  crossover  velocity  UCQ,  where  the  relative  contributions  are  eqval, 
defines  the  gain  of  each  parameter.  U  commonly  occurs  around  400  fps.  The 
term  accounts  for  the  pilot's  position  relative  to  the  center  of  gravity. 


30 


The  F-1H  and  A-7A  use  essentially  this  approach.  In  the  F-lll,  C*  ■  Unz  +  ♦ 
with  the  #  term  being  incorporated  into  the  n£  tent.  Pilot  acceptance  of  this 
scheme  is  excellent  which  speaks  highly  of  its  potential  for  fly-by-wire 
application. 

Boeing  has  proposed  the  use  of  the  time  history  of  C*  for  a  step 
command  as  the  new  handling  qualities  criterion  to  replace  the  Cornell 
"thumbprint"  currently  being  used.  The  thumbprint  defines  an  acceptable  area 
on  a  graph  of  short  period  frequency  «•*  versus  short  period  damping  t  •  The 
argument  is  that  because  the  pilot  senses  positions,  velocities,  and  accel¬ 
erations,  and  a  time  history  envelope  conveys  information  relating  to  all 
of  these,  a  time  history  envelope  is  more  likely  to  provide  correlation  with 
pilot  opinion  than  the  thumbprint.  The  thumbprint  is  deemed  Inadequate 
because  the  pilot  does  not  think  in  terms  of  w-{,  and  nonlinear  response 
cannot  be  properly  described. 

2.  PREVIOUS  FLY-BY-WIRE  WORK 

Investigations  into  fly-by-wire  control  techniques  both  in  this  country 
and  in  England  date  back  to  the  mid-1950's.  Unfortunately  a  major  share  of 
the  work  was  done  on  in-house  or  classified  projects  and  never  found  its  way 
into  the  literature.  Most  of  the  reported  work  has  been  done  on  three  mili¬ 
tary  funded  programs  starting  in  about  i960.  Currently  two  funded  programs 
and  at  least  two  in-house  programs  are  known  to  exist  in  the  United  States. 

A  number  of  fly-by-wire  systems  have  been  proposed  in  the  past  including  the 
B-70,  Concorde  SST  (France),  Avco  Vulcan  bomber  (England),  and  the  Gloster 
GA-6  fighter  (England),  but  the  only  system  ever  constructed  was  for  the  X-20 
Dynasoar  which  never  flew. 

a.  Funded  Studies 

The  early  funded  work  started  in  i960  when  Douglas  Aircraft  Company, 
Long  Beach,  California,  was  awarded  an  Air  Force  contract  for  study  of  an 
Electrical  Primary  Flight  Control  System  (Ref  9).  In  1962  the  Army  awarded 
Kaman  Aircraft  Corporation,  Bloomfield,  Connecticut,  a  contract  to  study 
Self-Contained  Electronic  Flight  Control  Systems  (Ref  10)  particularly  aimed 
at  VTOL  aircraft.  In  1963  the  Amy  also  awarded  Massachusetts  Institute  of 
Technology,  Instrumentation  Laboratory,  a  contract  to  study  "Advanced  Flight 
Control  Systems  Concepts  for  VTOL  Aircraft"  (Ref  11 ).  Ibis  last  program  was 
more  concerned  with  optimizing  flight  control  than  with  fly-by-wire. 

The  Douglas  study  began  in  i960  with  the  goal  of  replacing  the 
mechanical  flight  control  linkage  between  the  control  stick  and  the  surface 
actuators  with  an  electrical  link  in  which  no  electronics  or  switching  is  used. 
The  spectre  of  unreliable  vacuum  tubes  and  early  transistors  very  likely 
spawned  the  idea  of  eliminating  electronics.  Switching  was  eliminated  also 
for  reliability  reasons  Just  as  it  is  minimized  today,  ftie  system  operates 
directly  from  ship's  ac  power  to  eliminate  any  dc  conversion  equipment. 
Therefore,  the  control  stick  position  transducers  are  LVDT.'s  (linear  variable 
different ial  transformer),  signal  sunmation  uses  transformers,  and  the 
hydraulic  servovalves  use  ac  torquers.  Figure  19  shows  a  diagram  of  the 
system  for  the  pitch  axis.  The  system  employs  triple  redundancy  to  obtain 
the  desired  reliability  which  is  equated  to  the  Douglas  AD  Skyraider  pitch 
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control  system  reliability.  Monitoring  Is  performed  at  the  servovalve 
torquer  which  also  serves  as  the  naming  Junction  for  the  servo  input  and 
mechanical  feedback.  These  are  shown  schematically  in  figures  20  and  21. 

An  electromechanical  actuator  in  the  actuator's  feedback  linkage  supplies 
trim.  A  cockpit  display  presents  the  signals  from  the  three  servovalve 
to. quers  so  that  the  pilot  can  visually  monitor  operation  of  each  axis.  The 
slgnaj.  from  each  torquer  drives  one  of  three  small  bars  on  the  display. 

Under  normal  conditions  the  three  bars  move  together  to  form  a  line  that 
moves  up  and  down.  When  a  channel  fails,  its  bar  moves  away  from  the  other 
two.  The  pilot  then  notes  the  difference  and  disables  the  failed  channel  by 
manual  ly  operating  a  switch  that  places  a  choke  in  series  with  the  electrical 
signal  to  reduce  the  signal  to  a  very  low  value.  This  technique  is  in¬ 
adequate  because  the  monitor  distracts  the  pilot's  attention  from  his  more 
Important  flying  duties.  An  automatic  failure  detection  scheme  was  there¬ 
after  devised  to  eliminate  this  problem.  The  scheme  compares  the  torque 
generated  by  the  servovalve  torquer  flux  against  a  fixed  spring  torque.  When 
a  failure  causes  the  flux  to  exceed  105  percent  of  normal  maxlsnsn,  the  spring 
torque  is  overcome  to  operate  a  hydraulic  ahutoff  valve.  This  scheme  was  not 
Implemented  in  the  laboratory  model  so  that  neither  Its  effectiveness  nor 
switching  time  was  determined.  However,  failures  in  the  servovalve  second 
stages  would  escape  detection.  The  actuator  employs  three  tandem  rams  and 
three  servovalves  having  coupled  second-stage  spools.  Active  redundancy  Is 
employed. 

The  probability  of  a  failure  of  the  fly -by-vi re  system  was  estimated 
at  3*15  *  10-^  for  a  1.5  hour  mission  compared  to  6.15  *  10"**  for  the  original 
mechanical  system.  However,  the  probability  of  one  failure  occurring  was 
101.7  x  10"1*  and  20.1  x  10" ^  respectively .  In  other  words,  the  fly-by-wire 
system  would  incur  a  system  failure  only  half  as  often,  but  it  would  require 
maintenance  actions  five  times  as  often  as  the  mechanical  system. 

While  the  Douglas  study  showed  that  a  fly-by-wire  system  could  be 
designed  without  electronics  or  switching  to  match  the  reliability  of  a 
mechanical  system,  the  study  and  the  design  had  a  number  of  fallings.  First, 
the  study  failed  to  Include  any  discussion  of  artificial  feel  Implementation 
which  is  vitally  important  to  a  practical  fly-by-wire  system. 

Second,  the  ac  servovalve  torquers  are  very  inefficient  devices  which 
require  a  great  deal  of  electrical  power  from  the  stick  position  LVDT  for 
operation,  particularly  since  additional  torque  is  required  to  operate  with 
the  mechanical  feedback.  The  three  valves  require  a  total  power  of  50  watts. 
The  triplex  LVDT  absorbs  another  60  watts  at  its  maximum  displacement. 

Third,  the  size  and  weight  of  the  components  are  extremely  high  thus 
partially  negating  one  of  the  basic  advantages  of  fly-by-wire  of  size  and 
weight  reduction.  The  breadboard  models  of  LVET  and  servovalve  (excluding  the 
actuator)  weigh  30  and  55  pounds  respectively.  Although  flightworthy  com¬ 
ponents  would  certainly  weigh  natch  less  than  this,  the  trend  is  obvious.  For 
comparison,  a  triplex  signal  LVDT  would  weigh  about  5  ounces. 

Fourth,  the  magnetic  sunning  and  monitoring  techniques  are  not 
practical  for  two  reasons:  (l)  signals  from  different  power  supplies  cannot 
be  simased  inductively  unless  they  cue  exactly  synchronized;  otherwise  the 
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Figure  21 

Douglas  Electrical  Primary  Flight  Control  System  -  Electrical  Circuit 
Diagram  of  One  Channel  (Typical  of  Three) 


output  signal  will  bear  no  significant  relationship  to  the  desired  signal;  snd 
(2)  because  the  transfer  lapedance  of  a  transformer  depends  on  the  flux  level 
In  the  core,  the  output  level  for  one  Input  signal  depends  on  the  presence  and 
level  of  a  second  Input.  All  nonlinear  effect  causes  a  varying  forward  path 
gain  In  the  control  system. 

Fifth,  the  gradient  of  surface  deflection  per  control  stick,  displace¬ 
ment  Is  reduced  by  one-third  for  each  electrical  channel  failure.  One  chan¬ 
nel  failure  reduces  the  coMand  torque  at  the  servovalve  Input  to  tvo-thlxdB 
normal  which  is  balanced  by  the  feedback  torque  produced  by  two-thirds  normal 
surface  deflection.  The  change  in  control  authority  would  reduce  system 
performance  significantly  even  for  the  first  failure. 

Finally,  the  use  of  mechanical  feedback  and  coupled  servovalves  pre¬ 
sents  very  difficult  design  and  synchronisation  problems.  At  least  2  years 
were  spent  In  developing  a  prototype  model  with  only  limited  success.  We 
conclude  from  the  above  evaluation  that  the  Douglas  approach  Is  not  suitable 
for  use  In  fly-by-wire  systems.  Although  the  results  were  negative,  the 
program  has  provided  a  beneficial  contribution  to  fly-by-wire  development 
because  It  will  prevent  others  from  attenptlng  the  same  approach.  Work  for 
the  Air  Force  by  Douglas  Is  still  continuing  but  with  redirection  to  Include 
electronics  and  a  different  actuator  approach. 

The  Kaman  study,  which  began  in  1962,  had  the  purpose  of  determining 
whether  the  intrinsic  advantages  of  bc  If -contained  electronic  flight  control 
systems  (i.e. ,  fly-by-wire  systems)  could  be  realised  at  that  time  or  In  the 
near  future  while  maintaining  adequate  safety  and  reliability.  A  reliability 
goal  was  established  from  failure  rate  data  of  the  flight  control  systems  of 
aircraft  used  by  conmerclal  airlines.  The  goal  equals  the  running  average  of 
comnerclal  flight  control  system  failures  from  1952  to  1959,  which  Is  0.23 
failure  for  each  million  flight  hours.  Equivalent  values  for  military  opera¬ 
tions  were  not  available.  Kaman  employed  the  H-3^B  twin-rotor  helicopter  for 
comparison  of  fly-by-wlre  and  mechanical  systems.  Figure  22  shows  the  flight 
control  Installation  In  that  aircraft.  Figures  23  and  24  show  functional 
schematics  of  the  derived  electronic  flight  control  system  (EVCS)  for  the 
lateral  cyclic  and  collective  pitch  axes.  The  lateral  axis  is  Independent 
of  the  other  three  so  that  the  diagram  shows  the  basic  technique  derived. 

The  collective  axis  casinos  the  thrust  (or  lift)  snd  directional  axes,  and 
the  diagram  shows  the  required  Interconnections.  Figure  23  shows  that 
Kaman  has  used  standby  redundancy  to  achieve  a  fall -ope  rational  system. 

Triplex  induction  potentiometers  serve  vs  control  stick  transducers.  One 
transducer  provides  a  reference  for  comparison  with  the  active  transducer. 
When  a  failure  occurs  In  either  one,  the  monitor  switches  out  the  active 
unit  snd  switches  in  the  standby  one.  The  system  employs  dual  hydraulic 
actuators  in  standby  redundancy.  The  fault  detector  (monitor)  compares  the 
rms  values  of  the  comaand  and  servo  position  transducer  outputs  to  detect 
failures.  Upon  detecting  a  failure,  the  monitor  switches  out  the  active 
actuator  and  switches  in  the  standby  one.  The  probability  of  a  system  failure 
was  calculated  as  being  10"°  for  a  10-hour  mission.  However,  this  number  Is 
not  valid  for  several  reasons.  First,  the  generic  failure  rates  were  used 
which  assunes  that  the  application  K_  is  one.  However,  for  the  sources 
quoted,  Ka  *>  50  for  airborne  applications .  Hence,  the  channel  failure  rate 
Is  not  10.66  x  10'  °  but  rather  533  *  10”°.  This  alone  brings  the  probability 
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of  system  failure  up  to  (10  x  533  x  10"^ )2  =  28.4  x  10"6.  Further,  a  number 
of  single  elements  can  fail  that  will  cause  system  failure  (i.e.,  in  series 
with  respect  to  reliability).  These  include  the  monitors,  clutches,  and 
relays.  Also,  since  the  standby  channels  are  not  monitored,  the  monitor  could 
switch  in  a  failed  channel.  Assuming  an  optimistic  failure  rate  of  10“  5  for 
each  of  the  four  series  elements  (two  clutches  and  two  monitors  and  relays), 
the  probability  of  system  failure  becomes  4  x  10  x  10“ 5  +  28.4  x  10“°  =  4.28  x 
10"4  for  a  10-hour  mission  for  each  of  the  four  axes  for  a  total  system  rate  of 
1.8  x  10"3.  This  more  realistic  value  is  a  long  way  from  the  goal  of 
0.23  x  10"6.  The  results  of  this  system  design  study  point  up  the  need  for 
eliminating  the  series  reliability  elements,  monitoring  all  of  the  system 
elements,  and  employing  enough  channels  to  maintain  operation  after  two 
failures . 

The  MIT  study,  which  began  in  19^3  and  is  still  in  progress,  is  to 
develop  advanced  flight  control  systems  for  VTOL  aircraft.  The  objective  is 
to  develop  practical  control  systems  which  provide  optimum  control  character¬ 
istics  for  VTOL  aircraft  throughout  their  flight  regime  under  all  weather 
and  combat  conditions.  This  program  considers  the  manual  and  automatic  flight 
control  systems  as  an  integrated  system  to  provide  the  optimum  system.  The 
study  concerns  only  the  functional  aspects  of  the  control  system;  it  does  not 
consider  such  factors  as  reliability,  maintainability,  cost,  and  weight. 

The  MIT  and  Sperry  Phoenix  programs  are  approaching  the  problem 
of  optimizing  the  design  of  aircraft  control  systems  from  opposite  directions. 
Yet  they  are  arriving  at  very  similar  conclusions.  The  MIT  approach,  in  the 
process  of  determining  the  optimum  controller  configuration,  has  determined 
that  incorporating  the  fly-by -wire  approach  is  desirable.  The  Sperry  Phoenix 
approach,  in  the  process  of  determining  the  optimum  fly-by-wire  system 
configuration,  has  determined  that  incorporating  artificial  feel  (i.e.,  the 
controller)  is  desirable.  The  fact  that  the  MIT  study  is  limited  to  VTOL 
aircraft  does  not  alter  the  conclusions. 

MIT  is  currently  flight  testing  their  concepts  in  a  Vertol  CH-46C 
in  which  the  copilot's  mechauiical  system  has  been  replaced  by  an  electrical 
link  euid  the  advanced  flight  control  system.  The  pilot's  mechanical  controls 
remain  in  the  airplane  for  backup  Bince  the  advanced  system  is  nonredundant . 
Therefore,  in  the  strict  sense,  the  system  is  not  fly-by-wire  at  this  time; 
it  would  be  classified  as  a  pseudo  fly -by -wire  system  because  It  1ms  mechanical 
reversion  capabilities.  The  exact  system  implementation  is  not  known  except 
that  the  electrical  system  drives  through  the  mechanical  system  so  that  the 
safety  pilot's  controls  move  in  parallel  with  the  electrical  stick  inputs. 
Position  transducers  are  employed  on  the  copilot's  control  sticks  to  generate 
the  electrical  command  signals.  The  controller,  which  is  comparable  to  the 
artificial  feel  system,  consists  of  an  inertial  velocity  measurement  system 
for  flight  path  control  during  hover  and  cruise. 

b.  In-House  Studies 

In  addition  to  the  funded  studies,  a  number  of  in-house  programs  are 
known  to  have  existed  or  ere  presently  under  way.  Very  little  is  known 
about  the  results  of  these  works  since  they  seldom  find  their  vay  into  the 
literature.  Discovery  of  the  existence  of  such  programs  cooes  during  plant 


visits  or  private  conversations .  In-house  fly-by-wire  studies  are  known  to 
have  been  done  at  various  times  at  General  Dynamic s/Convair  (San  Diego)  and 
Fort  Worth,  M inne apo  1  i s -Honeyve  11 ,  North  American  Aviation  (Los  Angeles), 
Boeing  (Seattle),  Sud  Aviation  (France),  Avco  (England)  and  Elliott  Brothers 
(England).  In-house  studies  of  various  levels  are  now  under  way  at  the  Flight 
Dynamics  Laboratory  of  the  Research  and  Technology  Division  (Wright-Patterson 
Air  Force  Base)  and  Vertol  (Morton,  Pennsylvania). 

The  Convair  study  (Ref  12),  performed  in  1956-7,  was  one  of  the 
earliest  reported  works  in  fly -by -wire  control.  Convair  recognized  the 
problems  of  mechanical  control  system  designs  particularly  in  high-performance 
interceptor  aircraft.  They  also  recognized  the  benefits  of  a  closed-loop 
control  system  using  aircraft  rate  feedback  to  obtain  the  desirable  handling 
characteristics  (constant  stick  force  per  g  and  positive  trim  stability).  A 
moving  cockpit  simulator  having  a  single  degree  of  freedom  (pitch  axis) 
allowed  evaluation  of  their  concepts.  Both  center  and  side  Bticks  were 
available  for  evaluation.  System  evaluations  were  performed  by  giving  the 
pilot  a  task  of  tracking  a  target  or  holding  a  specific  attitude  while 
simulated  gust  disturbances  were  being  introduced.  The  conclusions  of  the 
study  were  that  a  fly-by-wire  could  be  designed  having  as  good  a  performance 
as  a  mechanical  system,  and  it  would  also  be  lighter  and  more  flexible. 
Further,  the  system  should  use  ac  transducers  and  active  triple  redundancy 
for  improved  reliability.  Although  the  confidence  level  of  achieving 
adequate  system  reliability  at  that  time  was  very  low,  the  confidence  in  the 
future  application  of  fly-by-wire  was  very  high. 

The  more  recent  work  at  General  Dynamics/Fort  Worth  investigated  the 
application  of  fly-by-wire  to  the  F-lll  to  reduce  weight  and  save  space. 

While  the  weight  and  volume  were  reduced  approximately  in  half,  the  question 
of  proven  reliability  prevented  its  application  except  for  the  spoilerB. 

These  are  discussed  later  under  Applications  and  described  in  Section  VIII. 

In  1958-9  Minneapolis-Honeywell  studied  the  application  of  fly-by-wire 
concepts  to  future  supersonic  aircraft  (Ref  13).  ThiB  theoretical  study  also 
concluded  that  fly-by-wire  systems  held  considerable  promise  in  solving  the 
growing  problems  of  mechanical  systems  —  if  only  the  reliability  could  be 
improved  to  match  that  of  the  mechanical  system.  The  proposed  solution  was  to 
use  a  fail-operational  primary  system  with  a  simple  Btandby  channel  for 
emergency  backup.  Again,  a  closed-loop  control  system  was  used  by  employing 
rate  and/or  acceleration  feedback,  but  surface  rate  was  also  added  as  a  feed¬ 
back  parameter  for  Integral  control.  The  liquid  metal  servovalve1  being 
developed  by  General  Electric  (Ref  14)  for  the  Air  Force  was  proposed  because 
it  has  no  moving  parts  and  should  be,  therefore,  very  reliable.  This  method 
uses  the  eutectic  alloy  of  sodium-potassium-cesium  which  remains  liquid  from 
-102*F  (-74.4*C)  to  -*-1332^  (a722*C).  Because  a  conductor  carrying  a  current 
in  a  magnetic  field  develops  a  force,  the  liquid  can  be  pumped  by  an  electro¬ 
magnetic  input  to  form  a  servovalve.  The  command  inputs,  electronics,  and 
feedback  sensors  are  triplex  and  fail-operational.  The  actuator  is  dual  but 
with  no  monitoring  specified.  Design  recommendations  include  separately 
routed  cables  using  wire  with  mixed  steel  and  copper  strands,  transformer 


1Development  of  NaKCe  components  is  still  underway  with  the  first  flight 
test  scheduled  for  1969- 


isolation  to  eliminate  the  effects  of  shorts,  the  use  of  inductive  trans¬ 
ducers,  and  reducing  the  number  of  connections  wherever  possible. 

The  B-70  Division  of  North  American  Aviation  (Los  Angeles)  investi¬ 
gated  the  application  of  fly-by-wire  techniques  to  the  XB»70  control  system. 
This  airplane  has  a  very  difficult  design  problem  because  the  cable  runs  sure 
very  long  and  routing  is  difficult.  This  was  discussed  previously.  The 
design  study  did  not  proceed  very  far  when  reliability  uncertainty  squelched 
the  project.  The  throttle  system  remained  electrical,  however,  because  an 
operational  mechanical  linkage  could  not  be  designed. 

Little  is  known  of  the  other  past  in-house  efforts.  Sud  Aviation 
originally  designed  the  Concorde  supersonic  transport  to  use  fly-by-wire 
control,  but  the  Federal  Aeronautics  Agency  demanded  mechanical  reversion 
capability  before  it  would  allow  the  aircraft  to  be  used  by  the  U.S.  carriers. 
Avco  (England)  at  one  time  proposed  a  fly-by-wire  conversion  of  the  Vulcan 
bomber,  but  it  was  not  accepted.  Elliott  Brothers  fabricated  a  highly 
redundant  cockpit  mockup  of  a  fly-by-wire  system  for  exhibit  and  demonstration 
at  an  Aviation  Exposition  in  England  in  1963. 

The  Flight  Dynamics  Laboratory  (IDL)  in-house  program,  which  began 
in  1966,  is  aimed  at  converting  a  B-U7  to  fly-by-wire  to  provide  flying  proof 
of  its  feasibility.  The  conversion  will  progress  in  stages  beginning  in  1967 
with  a  nonredundant  pitch  axis  system  having  mechanical  reversion.  Flight 
tests  will  provide  checks  on  the  performance  characteristics.  A  C*  feedback 
system  will  then  be  installed  in  conjunction  with  a  side-stick  controller. 

The  side-stick  controller  and  C*  feedback  will  then  be  used  with  a  redundant 
servo  actuator  using  hydraulic  logic.  The  final  phase  of  the  in-house  program 
will  be  test  of  a  liquid  metal  actuator  package  with  C*  feedback  and  a  side- 
stick  controller.  The  Sperxy  Rioenix  program  is  related  to  and  operates  on  a 
parallel  timetable  with  the  FDL  program.  Sperry  is  tentative1’’-  scheduled  to 
fly  a  redundant  three-axis  system  in  1969  in  a  second  B-U7. 

The  Vertol  in-house  study  program  is  in  the  preliminary  stages  of 
planning.  The  program  is  concentrating  on  applications  of  fly-by-wire 
techniques  to  future  VTOL  aircraft  of  all  types  and  sizes  including  rotary 
and  tilt  wing.  Vertol  refers  to  the  electrical  flight  control  system  which 
replaces  the  mechanical  system  as  an  Advanced  Flight  Control  Linkage  (AFCL) 
rather  than  a  fly-by-wire  system.2  Preliminary  planning  calls  for  design, 
fabrication,  laboratory  test,  and  flight  test  of  a  prototype  system  in  a 
CH-1j6  helicopter.  Sperry  has  recctmended  a  fly-hy-wire  implementation  for 
the  AFCL  based  on  the  results  of  the  present  study  program.  The  system  is 
described  in  Section  VIII. 

c.  Applications 

While  the  applications  of  fly-ly-wire  technology  to  aircraft  are  very 
limited,  other  applications  range  from  submarines  to  space  vehicles.  Known 


Sfery  likely  the  study  has  been  strongly  influenced  by  the  MIT  program  which 
is  using  a  Vertol  CH-l<6  machine  for  flight  test  work.  MIT  refers  to  their 
optimum  controller  as  an  Advanced  Flight  Control  System. 


applications  include  the  X-20  Dynasoar.  the  Mercury-Gemini  capsule  series, 
Apollo  and  LEM  (lunar  excursion  module),  F-lll  spoiler^,  and  XB-70  and  CL-44 
Argus  throttles.  The  throttle  system  problems  were  discussed  earlier. 

Several  applications  have  been  proposed  and  denied  as  we  have  already  men¬ 
tioned.  A  proposed  English  fighter,  the  Gloster  GA-6,  was  to  have  had  a 
fly-by-wire  system,  but  the  entire  program  was  cancelled  at  an  early  stage. 

No  information  has  been  obtained  on  this  aircraft. 

A  little-known  fact  in  the  aerospace  industry  is  that  the  newer 
submarines  use  fly -by -wire  control  or,  in  6ome  cases,  fly-by-fluid  control. 
This*  fact  is  not  60  surprising  when  we  stop  to  consider  that  the  control 
mechanization  problems  are  not  much  different  in  submarines  than  in  aircraft. 
They  are  also  subject  to  friction,  deadzones,  compliance,  hysteresis,  back¬ 
lash,  routing  problems,  and  body  bending.  Their  control  frequencies  are 
several  orders  of  magnitude  lower,  but  they  are  "flown"  through  the  water  by 
an  operator  who  contruls  pitch,  roll,  and  yaw  control  surfaces  much  like  en 
aircraft.  At  least  one  hydrofoil  craft  was  known  to  have  used  electrical 
control  linkages  from  the  cockpit  to  the  foil  actuators. 

The  X-20  Dynasoar  flight  control  system  (Ref  15)  is  the  only  known 
existing  fly-by-wire  system,  yet  even  this  system  never  flew.  The  X-20 
simulator,  which  uses  most  of  the  prototype  hardware,  is  located  at  the  Flight 
Dynamics  laboratory  of  the  Research  and  Technology  Division,  Wright -Patterson 
Air  Force  Base.  Figure  25  shows  a  block  diagram  of  the  elevon  control  system. 
Most  of  the  details  of  the  aircraft  are  still  classified,  but  conventional 
automatic  flight  control  system  design  techniques  were  employed.  The  signifi¬ 
cant  points  for  the  purpose  of  this  study  are  as  follows.  The  primary  control 
system  is  fail-operational  with  an  additional  direct  electrical  link  avail¬ 
able  for  emergency  backup  control.  The  system  is  functionally  very  similar 
to  the  F-lll  flight  control  system  in  that  it  uses  essentially  C*  feedback 
and  an  adaptive  gain  control  loop  to  maintain  maximum  servo  gain  and  optimum 
handling  characteristics.  While  the  adaptive  gain  control  is  triplex  in 
both  systems,  the  remainder  of  the  X-20  system  differs  in  that  it  is  only 
duplex.  In-line  monitoring  and  hardover  detectors  continuously  and  indepen¬ 
dently  check  each  channel  to  achieve  the  fail-operational  capability.  In 
case  both  channels  fail*,  a  direct  link  is  available  to  provide  a  fixed  sur¬ 
face  deflection  per  stick  deflection  gradient.  The  backup  link  has  no  arti¬ 
ficial  feel,  of  course,  and  operators  find  flying  it  through  the  transonic 
range  almost  impossible.  The  probability  of  a  system  failure  for  a  14iour 
flight  is  estimated  to  be  3  *  10"°  which  is  still  an  order  of  magnitude 
higher  than  the  Kaman  criterion  of  2-3..X  10"T  for  a  1-hour  flight  (commer¬ 
cially).  Since  presumably  the  3  x  10“°  figure  is  acceptable,  the  ratio  of 
10:1  could  establish  the  criterion  for  military  flight  control  systems  safety 
with  respect  to  commercial  flight  safety. 

The  vehicles  of  the  various  space  programs,  Mercury,  Gemini,  Apollo, 
and  LEW,  use  fly -by-wire  techniques  to  save  weight  and  space.  The  Mercury 
system  was  actually  a  pseudo  fly-by-wire  system  since  it  had  a  mechanical 
backup  system.  The  surprising  fact  about  these  systems  is  that  they  tend  to 
use  nonredundant  channels  and  stress  the  alternate  modes  approach  to  re¬ 
dundancy  rather  than  replicating  channels.  For  example,  the  LEM  has  three 
alternate  modes  of  control  varying  degrees  of  degraded  performance  from  the 
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Figure  25 

X-20  Elevon  Control  System 
Block  Diagram 
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primary  mode.  (The  X-20  had  two  alternate  modes  although  replication  was 
used.)  By  using  we1 1-tested,  high-reliability  components  (such  as  Minut.eman 
quality),  single-channel  reliability  can  be  made  very  high  for  these  rela¬ 
tively  simple  systems.  Pilot  monitoring  further  simplifies  them.  The 
adequacy  of  pilot  monitoring  for  space  vehicles  was  borne  out  when  Gemini  ex¬ 
perienced  a  primary  roll  axis  hardover  failure  during  the  docking  me  leuver 
with  the  Agena  target  vehicle.  The  failure  was  Isolated,  the  primary  axis 
deactivated,  ana  the  secondary  system  activated  within  a  matter  of  a  few 
seconds.  This  type  of  operation  is  allowed  because  such  limited  tumbling 
motions  generally  cause  no  harm  as  long  as  the  pilots  do  not  become  dis¬ 
oriented.  Little  danger  of  collision  exists  except  possibly  while  docking. 

The  F-lll  spoilers  are  fly-by-wire  for  two  reasons.  First,  it  is 
required  because  of  the  difficult  design  problem  presented  by  the  swing  wing; 
and  second,  it  is  allowed  because  the  spoilers  are  secondary  roll  control 
devices  which  are  active  when  the  wing  sweep  is  less  than  45  degrees.  The 
rolling  tail  furnishes  the  primary  roll  control.  Performance  of  this  system 
is  being  watched  with  interest  because  it  is  the  first  semblance  of 
fly-by-wire  in  an  operational  aircraft.  Over  2,000  flight  hours  have  accu¬ 
mulated  on  these  spoilers  as  of  this  writing  vithout  a  system  failure. 
Component  failures  have  occurred  in  the  servos.  They  have  been  caused  either 
by  faulty  manufacture  or  by  the  incompatibility  of  some  of  the  exotic  metals 
being  utilized,  namely  titanium  bearing  on  titanium.  These  problems  re¬ 
portedly  have  been  eliminated. 

The  problem  posed  by  the  swing  wing  is  that  the  hinge  point  for  the 
spoiler  control  linkages  varies  with  wing  sweep  angle.  A  very  complex 
mechanical  arrangement  would  be  required  to  accommodate  these  variations. 
Therefore,  electrical  linkages  have  been  implemented  to  solve  the  problem. 
Dual  redundancy  is  employed  since  two  sets  of  spoilers  are  used  on  each  wing. 
A  nonredundant  actuator  and  channel  operates  each  spoiler.  When  one  spoiler 
fails,  it  is  locked  down  along  with  its  mate  on  the  other  wing  to  maintain 
symmetry. 

One  other  application  of  fly-by-wire  which  may  come  about  soon  is  on 
the  lift  fan  VTOL  in  which  the  thrust  diverter  louvers,  particularly  in  the 
wing,  are  very  difficult  to  control  mechanically.  This  problem  occurs  in  the 
VS/FRG  Mach  2  VTOL  Fighter. 

3.  RELATED  WORK 

In  addition  to  the  known  fly-by-wire  studies  which  have  been  discussed  in 
the  preceding  sections,  a  number  of  other  programs  and  systems  exist  that 
are  strongly  related  to  fly-by-wire  systems  design  and  technology.  Such 
programs  included  command  or  control  augmentation  systems,  fully  boosted 
control  systems,  model  reference  flying  simulators  and  redundant  flight 
controls. 


Command  augmentation  is  a  technique  of  paralleling  the  mechanical  control 
coemand  with  an  electrical  stick  coomand  signal  into  the  stability  augmenta¬ 
tion  system.  The  electrical  signal  bypasses  the  friction  and  nonlinear  it  ies 
of  the  mechanical  system  for  improved  control.  This  technique  is  also  called 
control  stick  steering.  The  stick  transducer  may  be  either  position  or  force; 
both  are  used.  The  signal  can  be  shaped  to  provide  the  desired  rate  response 
from  the  aircraft  since  a  command  or  control  augmentation  system  is 
effectively  a  limited-authority  (because  the  SAS  normally  is  authority  limited) 
rate  autopilot.  The  resulting  control  system  provides  more  accurate  rate 
control.  With  high  SAS  gains,  the  system  provides  a  very  high  static 
stiffness  to  the  control  system  producing  an  effect  much  like  integral  con¬ 
trol.  Normal  acceleration  feedback  :■  then  added  to  achieve  better  response 
at  high  speeds  where  the  rate  response  drops  off.  The  rate  loop  then  domi¬ 
nates  control  at  low  speeds  where  the  acceleration  response  drops  off.  The 
addition  of  acceleration  feedback  also  eliminates  dependence  on  air  data  l'or 
gain  control.  With  the  addition  of  acceleration  feedback,  the  CAS  becomes 
more  than  a  rate  autopilot.  It  becomes  essentially  what  has  been  called  a  C* 
command  system  in  parallel  with  the  mechanical  control  system.  Gain  control 
of  the  inner  stability  augmentation  loops  may  be  either  fixed  or  variable 
through  adaptive  controllers.  The  system  provides  heavy  gust  damping  while 
providing  fast,  well-controlled  responses  to  commands.  The  resulting  CAS  is 
a  full-time  system  which  becomes  the  primary  control  system  with  the  mechan¬ 
ical  system  being  used  as  a  backup.  This  i6  the  approach  being  used  on  the 
A-7A  (Ref  1 6)  with  fixed  gains  and  on  the  F-lll  (Ref  17)  with  adap^We  gains. 
Pilot  conments  on  the  handling  qualities  of  these  systems  are  very  iavorable. 
The  approach  will  also  be  utilized  in  the  newer  high-performance  aircraft  such 
as  the  SST,  Boeing  7^7,  advanced  manned  strategic  bomber  (AMSA),  and  the 
advanced  fighter/ attack  aircraft  (VFAX/FX). 

The  importance  of  CAS  to  fly-by-wire  technology  should  be  obvious  from  its 
functional  similarity.  Removal  of  the  mechanical  backup  controls  from  a  CAS 
leaves  a  system  very  similar  to  fly-by-wire. 

Fully-boosted  control  systems  are  of  interest  primarily  because  they  are 
irreversible  and  require  artificial  feel  as  does  fly-by-wire.  The  problem 
of  implementing  artificial  feel  or  in  optimizing  the  controller  is  common 
ground  which  we  have  already  discussed.  The  oast  and  continuing  work  being 
done  in  this  area  is  directly  applicable  to  fly-by-wire  technology. 

Another  facet  of  boosted  systems  of  interest  is  their  mechanical 
reversion  capability.  Mechanical  reversion  allows  the  pilot  time  to  recover 
control  while  correcting  or  clearing  a  fault  (if  possible).  Runaway  or 
hardover  controls  are  the  primary  reason  for  mechanical  reversion  rather  than 
power  failure.  The  lack  of  mechanical  reversion  is  the  biggest  deterent 
to  the  application  of  fly-by-wire  control  today.  Yet  the  Caravelle  commercial 
transport  has  no  mechanical  reversion.  It  relies  on  triplex  hydraulic 
supplies  and  actuators  to  provide  necessary  reliability.  This  aircraft  has 
supplied  an  important  leBson  in  f  ly-fn -wire  design:  route  the  separate  con¬ 
trol  and  power  lines  aB  far  apart  as  possible.  A  Caravelle  was  lost  because 
the  design  violates  this  rule.  All  of  the  aileron  hydraulic  lines  pass 
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through  the  wheel  velle.  A  brake  fire  In  one  of  the  wheel  well6  burned 
through  all  of  the  hydraulic  lines  causing  loss  of  lateral  control  and  the 
airplane.  Hopefully,  this  problem  has  been  eliminated. 

A  flying  simulator  is  an  aircraft  modified  by  t.he  addition  of  an  electri¬ 
cal  flight  control  system  ir.  which  the  dynamic  characteristics  of  the  air¬ 
craft  can  be  modified  through  an  electronic  model  for  study  of  stability  or 
handling  qualities  or  for  study  of  the  flight  characteristics  of  proposed 
aircraft.  The  original  flight  control  system  is  retained  for  nomal  flying 
and  for  safety  since  the  electrical  system  is  always  nonredundant .  The  two 
systems  are  functionally  independent  up  to  the  point  where  the  simulated 
system's  output  sums  into  the  original  system  which  usually  occurs  at  a  series 
actuator.  The  electrical  system  is  functionally  related  to  fly -by -wire 
systems  in  that  it  employs  various  electrical  sticks  and  it  can  vary  and  con¬ 
trol  the  handling  qualities  of  the  airplane.  The  USAF  and  NASA  have  modified 
a  number  of  fighter  and  small  bomber  aircraft  (such  a6  the  B-25,  F-9^,  F-101, 
and  F-102)  for  variable  stability  studies,  to  evaluate  sidestick  controllers 
and  adaptive  flight  control  systems,  and  to  simulate  such  aerospace  vehicles 
as  the  X-15  and  X-20  for  pilot  training.  We  have  already  mentioned  the  con¬ 
verted  CH-46  that  MIT  is  using  for  advanced  flight  control  system  studies. 
Boeing  (Seattle)  has  converted  their  707  prototype,  the  Model  367-80,  for 
variable  stability  and  handling  qualities  studies.  Gruimnan  is  building  for 
the  Navy  seven  copies  of  the  TC-^C,  which  is  a  modified  Gulf  stream  I,  that 
will  simulate  the  A-6A  for  flight  training.  A  complete  A-oA  cockpit  will  be 
constructed  in  the  passenger  compartment,  and  all  of  the  A-6A  avionics  will 
be  Included  in  the  airplane.  Cornell  is  modifying  a  Convair  C-131  (a  turbo¬ 
prop  version  of  the  C-31^)  for  a  total  in-flight  simulation  of  such  advanced 
aircraft  as  the  AMSA,  SST,  and  C-5A.  An  entire  cockpit  and  nose  section  will 
be  added  forwurd  of  the  existing  cockpit  which  will  be  retained.  The  added 
section  will  be  changeable  to  allow  simulation  of  the  various  aircraft. 
Variable  stability  flying  and  simulation  will  be  done  by  using  response- 
feedback  techniques  as  well  as  by  model-reference  techniques  vising  an  on-board 
computer. 

The  application  of  redundancy  to  flight  control  system  design  is  of 
particular  interest  to  fly-by-wire  technology  because  through  its  application, 
the  required  system  reliability  and  safety  result.  Redundancy  has  been 
applied  primarily  to  those  subsystems  of  an  aircraft  affecting  flight  safety 
such  as  the  SAS,  CAS,  or  the  AFCS  in  all-weather  landing  (AWL)  modes.  The 
degree  of  applied  redundancy  relates  to  the  degree  that  the  system  affects 
flight  safety.  The  SAS  or  CAS  in  most  high  performance  aircraft  is  now  or 
will  be  triplex.  Such  aircraft  include  the  B-J>8,  F-lll,  X-15,  X-20,  SST, 

7^7 ,  C-5A,  AAFSS,  and  IHAS.  When  Category  IIl3  AWL  comes  to  pass,  the 
AFCS  will  very  likely  be  triplex.  These  systems  are  mostly  required  to  be 
fail  operational.  Triple  redundancy  with  voting  is  the  brute  force  technique 
of  gaining  that  end;  it  is  inefficient  and  adds  undue  complexity,  cost,  and 


3 

Category  III  has  several  subclasses,  but  it  essentially  refers  to  zero 
visibility  conditions. 
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weight  to  the  Bystem-  Fly-by -wire  By6temB  require  a  greater  failure  tolerance 
6ince  they  must  generally  operate  after  double  failures  to  obtain  the  desired 
degree  of  reliability  and  safety.  This  means  either  employing  a  higher  degree 
of  redundancy,  using  more  finesse  in  applying  redundancy  to  optimize  it,  or 
both.  Sperry  Phoenix  has  had  a  program  for  several  years  which  uses  finesse 
in  optimizing  redundancy.  The  technique,  called  fail-passive  design  (Ref  l8), 
designs  out  the  causes  of  active  (i.e.,  hardover )  failures  so  that  the 
resulting  channels  or  components  fail  in  a  passive  manner  on^y.  A  fail- 
passive  component  or  channel  fails  in  6uch  a  v<y  that  it  has  no  output  and 
does  not  interfere  with  the  normal  operation  of  a  parallel  component  or 
channel.  By  using  fail-passive  design,  a  fail-safe  system  requires  only  one 
channel  not  two,  a  fail-operational  system  requires  only  two  channels  not 
three,  and  so  on.  Furthermore,  little  or  no  monitoring  or  switching  equip¬ 
ment  is  necessary. 


To  demonstrate  the  power  of  this  new  design  tool,  consider  a  repre¬ 
sentative  control  channel  having  a  total  failure  rate  A  of  10“4  each  hour. 
Typically,  the  relative  probability  of  a  hardever  failure  in  control  channels 
ranges  between  0.1  and  0.5;  let  us  assume  0.5.  Therefore,  the  total  failure 
rate  of  the  channel  consists  of  the  sum  of  the  active  failure  rate  Aa  of 
5  x  10"5  each  hour  and  the  passive  failure  rate  A_  of  5  x  10"5.  Assuming 
our  system  has  two  parallel  channels,  an  active  failure  in  one  channel  pre¬ 
vents  the  normal  operation  of  the  other  so  that  the  system  fails.  Therefore, 
the  probability  of  a  system  failure  Q  is  the  sum  of  these  failures.  Passive 
failures  allow  the  other  channel  to  continue  working.  Q  is  the  product  jf 
these  failures  because  both  channels  must  fail  in  order  to  constitute  a  sys¬ 
tem  failure.  The  system  failure  is  then  the  sum  of  the  two  terms 
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where  t  is  time  and 


Q  *  2  x  5  x  10"5  x  1  +  (5  x  10-5  x  yhej-g  t  «  i  hour 


Q  -  10-4  +  2.5  x  10 ”9 

Note  that  the  active  failure  term  dominates  by  five  orders  of  magnitude  over 
the  passive  failure  term.  If  all  failures  were  passive,  then 

Q  =  (l0’4  x  l)2  =  10-8 


The  state  of  the  art  in  fail-pa  ive  design  can  reduce  the  relative  probabil¬ 
ity  of  active  failures  to  about  0,1  percent.  For  our  example,  then  Aa  =  10"' 
each  hour,  A  r  10 "4  -  10'7  ~  10 '4  each  hour,  and 


or 


Q  «*  2  x  10"7  +  (10“4  x  l)2 
Q  =  2  x  10"7  +  10"8  =  2.1  x  10"7  for  1  hour. 


This  represents  three  orders  of  magnitude  improvement  in  system  reliability 
through  fail-passive  design  techniques. 
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We  can  further  compare  the  fail-pas6ive  approach  to  the  <'onventional 
triplex  voted  method  which  requires  three  channels  plus  three  comparators 
and  voting  logic.  The  failure  rate  of  the  monitor  equipment  per  channel 
will  typically  be  no  more  than  10  percent  of  the  channel  failure  rate  or  10" 
in  this  case.  We  can  further  make  the  blithe  assumption  that  monitors  are 
fail-safe  (l.e.,  indicate  their  own  failures)  so  that  monitor  failures  do  not 
cause  system  failure  unless  all  three  fail.  In  a  conventional  triplex  system, 
the  monitor  votes  out  the  first  failed  channel  leaving  two  working  ones.  On 
a  second  failure  the  monitor  cannot  determine  which  channel  has  failed  so 
both  are  turned  off.  Therefore,  the  system  requires  that  two  of  the  three 
channels  work  for  success,  and  because  the  monitors  do  not  differentiate 
between  types  of  failures 

Q  =  3(At)2 


For  our  example 

Q 


3  (10’4  x  1 V 


3  x  10 


i-8 


whif'h  is  very  close  to  the  Q  of  the  fail-passive  system.  However,  the  total 
failure  late  of  the  triplex  vote'’  and  fail-passive  systems  are  3*3  x  10"^  and 
2  x  10"^  respectively.  The  relative  cost,  size,  and  weight  will  be  in 
approximately  this  same  ratio  of  1.65:1. 
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SECTION  IV 

DISCUSSION  OF  FLY- BY- WIFE  CONTROL 


1.  INTRODUCTION 

The  preceding  section  has  d  scribed  briefly  the  evolution  of  flight 
control  systems,  discussed  the  problems  of  mechanical  control  systems,  and 
shown  how  flight  control  systems  are  evolving  toward  fly-by-wire.  The 
benefits  of  fly-by-wire  with  the  help  of  sane  examples  will  next  be  detailed, 
and  then  a  fly-by-wire  control  system  with  same  indications  of  needed 
development  will  be  described  functionally. 

2.  BENEFITS  OF  FLY- BY- WIFE 

Our  definition  states  that  a  fly-by-vire  control  system  is  an  electrical 
primary  flight  control  system  e relaying  feedback  such  that  vehicle  motion  is 
the  controlled  parameter.  Fly-by-wire  provides  a  redundant  integrated  flight 
control  system  with  the  reliability  and  flexibility  necessary  to  solve  the 
increasingly  complex  problems  of  flight  controls.  This  solution  to  the  flight 
controls  problem  results  in  additional  benefits.  A  reduction  of  control  sys¬ 
tem  wei'ht  of  150  to  750  pounds  may  be  realized  by  fly-by-wire  controls  with 
recovery  of  a  major  part  of  the  volume  nonr^ly  allowed  for  control  linkages, 
cable  motions,  and  artificial  feel  devices.  The  weight  and  space  savings  could 
be  used  for  other  aircraft  subsystems  or  to  improve  aircraft  performance. 

The  weight  reduction  would  especially  enhance  VTOL  performance  where  the  power 
to  weight  ratio  is  often  marginal.  Control  system  performance  is  improved  by 
the  elimination  of  the  compliance,  friction,  and  inertia  of  the  mechanical 
linkages.  Since  the  control  system  and  airframe  are  mechanically  uncoupled 
except  at  the  actuator,  the  effects  of  airframe  flexibility  and  temperature 
variations  are  reduced  to  a  minimum.  Fly-by-wire  techniques  provide  these 
performance  gains  and  weight  and  space  savings  with  a  reduced  initial  design 
effort  and  with  simplified  installation  and  maintenance.  Fly-by-wire  also 
provides  a  means  of  standardizing  flight  controls  between  aircraft  and  in¬ 
creasing  the  flexibility  of  cockpit  installations.  An  additional  benefit  of 
fly-by-wire  controls  is  their  reduced  vulnerability  to  battle  damage.  This 
fact  alone  makes  fly-by-wire  controls  attractive  to  military  users.  To  meet 
the  control  system  reliability  requirements,  fly- by-wire  controls  employ  re¬ 
dundancy  techniques.  Redundancy  implies  an  increase  in  the  number  of  com¬ 
ponents  and  an  increase,  therefore,  in  the  number  of  maintenance  actions 
required.  However,  modular  packaging  and  failure  reporting  circuits  lower 
maintenance  time  so  that  the  overall  maintenance  costs  will  actually  be  less. 
The  main  disadvantage  fly-by-wire  has  to  overcame  is  the  lack  of  confidence  in 
system  integrity  caused  by  a  distrust  of  nonmechanical  system  reliability. 

A  simplified  diagram  of  the  F-lll  mechanical  pitch/roll  control  was  shown 
in  figure  9  of  Section  II.  Figure  26  shows  an  equivalent  fly-by-wire  system 
mechanization  of  this  system.  The  relative  simplicity  of  the  fly-by-wire 
system  is  obvious  even  though  it  is  highly  redundant.  Section  VIII  contains 
a  comparative  analysis  of  the  weight,  volume,  and  cost  of  the  F-lll  control 
system  and  a  fly-by-wire  equivalent.  The  results  are  shown  in  table  XV  of 
that  section.  The  results  show  about  a  50-percent  reduction  in  weight  and 
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volume .  The  results  of  a  similar  weight  analysis  "by  General  Dynamics  are  in¬ 
cluded  for  comparison.  The  General  Dynamics  weights  essentially  corroborate 
Sperry's  estimates.  A  cost  savings  greater  than  the  15  percent  shown  would 
result  because  savings  in  design  costs  are  not  reflected.  The  F-lll  will  be 
discussed  later. 

On  the  XB-70  flight  control  system,  North  American  originally  proposed  a 
fly-by-wire  approach.  Unfortunately,  this  approach  was  discarded  in  favor 
of  a  more  conservative  approach,  and  the  design  wound  up  mechanical.  The 
schematic  diagrams  of  the  pitch  and  roll  axes  are  shown  in  figures  27  and 
28.  The  appendix  contains  a  complete  mechanical  diagram  of  the  system.  It 
demonstrates  the  magnitude  of  complexity  to  be  expected  in  such  large  air¬ 
craft  as  the  SST,  AMSA,  and  C-5A.  At  the  conclusion  of  the  design  of  the 
XB-70,  the  designers  compared  notes  on  the  two  approaches.  They  determined 
that  the  fly-by-wire  approach  would  have  saved  675  pounds  and  90,000  of  the 
100,000  hours  of  design  time. 

Fly-by-wire  would  have  provided  many  other  advantages  in  the  XB-70 
according  to  the  designers.  In  addition  to  eliminating  the  control  linkage 
routing  and  fuel  cell  seal  problems  described  in  Section  III,  it  would  have 
also 

a.  Saved  space 

b.  Provided  better  control  resolution 

c.  Reduced  inertia 

d.  Eliminated  high-temperature  bearings 

e.  Eliminated  mass  unbalance  in  the  control  system 

f.  Been  more  flexible  to  design  changes 

g.  Been  easier  to  make  redundant 

h.  Reduced  the  interface  problem  with  the  other  aircraft  Bubsysuoms 

Fly-by-wire  would  also  allow  the  use  of  sidestick  controllers  which  would 
allow  moving  the  displays  closer  to  the  pilot  and  would  reduce  pilot- 
inertial  coupling. 

The  CH-46  study,  which  is  also  detailed  in  Section  VIII,  demonstrates 
that  fly-by-wire  can  cut  the  weight  of  the  control  system  from  55O  to  135 
pounds.  By  similarity,  the  same  fly-by-wire  system  would  work  in  the  CH-Vf 
as  well,  and  it  would  cut  that  aircraft's  control  system  weight  from  880  to 
135  pounds.  Furthermore,  the  maintenance  time  for  each  flight  hour  would  be 
reduced  by  approximately  two  orders  of  magnitude.  A  Douglas  study  of  the 
proposed  DC-10  flight  control  system  indicated  that  fly-by-wire  would  provide 
a  weight  savings  of  230  pounds  for  a  linkage  system  that  is  almost  entirely 
cables.  The  weight  savings  for  the  F-lll  and  B-52H  (Section  VIII )  would  be 
277  and  415  pounds,  respectively. 

The  use  of  fly-by-wire  techniques  accrues  some  additional  benefits 
because  of  its  design  flexibility  and  simplified  interfaces.  The  Air  Force 
has  a  study  program,  being  performed  by  the  Bendix  Corporation,  to  determine 
whether  the  flight  control  system  can  be  employed  to  aJleviate  gust  loads  on 
the  airframe.  The  study,  being  performed  on  the  B* 52H,  is  trying  to  find  out 
whether  reducing  the  peak  airframe  Btress  levels  can  lengthen  the  service 
life  of  large  expensive  aircraft.  The  approach  being  used  is  essentially  to 
add  a  CAS  which  modifies  the  control  signals  in  such  a  way  as  to  prevent 
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Figure  27 

XB-70  Pitch  Axis  Control  System 


Figure  28 

XB-70  Roll  Axis  Control  System 


large  commands  from  overstressing  the  airframe  and  to  attenuate  body  bending 
modes.  Control  signal  modification  may  be  done  with  precisely  fixed  filters 
or  through  adaptively-controlled  variable  filters.  Since  the  means  to 
add  such  a  capability  to  a  fly -by -wire  system  would  already  exist,  an  imple¬ 
mentation  could  be  readily  incorporated.  A  similar  situation  exists  with 
direct  lift  control  in  which  wing  lift  is  controlled  directly  (through  the 
use  of  high-speed  flaps,  collective  ailerons  or  spoilers,  or  boundary  layer 
control)  to  improve  flight  path  control  particularly  during  landing.  Such  a 
scheme  could  be  more  easily  implemented  in  a  fly-by-wire  system  than  a 
mechanical  system.  In  fact,  the  Navy  is  adapting  the  A-7A  to  direct  lift 
control  through  fly-by-wire  techniques. 

3.  FLY-BY-WIRE  SYSTEMS  DESCRIPTION 

From  a  systems  viewpoint,  the  flight  control  system  should  allow  the 
pilot  to  maintain  direct  and  effective  path  control  under  all  flight  condi¬ 
tions  with  a  minimum  of  error  and  effort.  Direct  and  effective  implies  that 
simple  commands  should  produce  flight  path  corrections  with  adequate  speed 
and  precision.  Effort  includes  mental  as  well  as  physical.  The  fundamental 
decisions  on  the  control  philosophy  must  be  guided  by  intuitive  principles, 
involving  simplicity,  reliability,  and  the  integration  of  sensors,  computa¬ 
tions,  and  controls.  A  well-behaved  system  is  best  obtained  through  a 
closed-loop  approach  in  which  the  desired  flight  path  is  the  input  and  the 
actual  flight  path  and  dynamic  response  parameters  to  be  controlled  are  fed 
back. 

The  pitch,  roll,  and  yaw  axes  of  the  fly-by-wire  control  system  that 
has  evolved  from  our  studies  are  shown  in  figures  29,  30  >  and  31-  The 
technique  is  very  similar  to  the  conmand  or  control  augmentation  schemes 
employed  in  the  F-lll  and  A-7A.  The  pitch  axis  employs  the  C*  blend  of  pitch 
rate  and  normal  acceleration  feedback.  The  roll  axis  feeds  back  roll  rate  p, 
while  the  yaw  axis  feeds  back  yaw  rate  r,  and  lateral  acceleration  ny.  The 
requirements  for  ny  feedback  depends  on  the  airplane;  it  is  generally  re¬ 
quired  to  eliminate  sideslip  during  maneuvers  thereby  providing  automatic 
coordination. 

The  closed-loop  control  systems  in  conjunction  with  the  spring  re¬ 
strained  control  stick  provide  the  necessary  artificial  feel.  The  feedback 
signals  are  compared  with  the  conmand  signals  from  the  stick  position  (or 
force)  transducers  which  have  been  shaped  by  a  conmand  model.  The  difference 
is  an  error  signal  which  drives  the  control  surface  through  a  high  gain 
servo.  In  operation,  the  higher  the  forward  gain  K,  the  less  effect  the 
aircraft  dynamics  have  on  the  feel  and  the  more  the  aircraft  feels  like  the 
model.  Aircraft  feel,  therefore,  can  be  readily  tailored  for  any  aircraft  (to 
personal  preference  if  desired)  using  essentially  the  same  system.  Adaptive 
control  can  be  added  to  optimize  the  response  for  all  flight  conditions  by 
keeping  the  K  as  high  as  stability  will  allow.  The  more  simple  fixed  gain 
(or  manually  varied  gain)  normally  supplies  adequate  performance  by  selecting 
the  highest  gain  usable  at  the  worst  case  flight  condition. 

When  the  highest  possible  loop  gains  are  used,  the  control  system 
response  approaches  that  obtained  by  integral  control.  Integral  control 
provides  all  of  the  advantages  of  attitude  displacement  feedback  for  accurate 
path  control  while  retaining  good  conmand  response  characteristics.  Integral 
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Figure  29 

Simplified  Block  Diagram  of  Fly-By-Wire  Control  System  -  Pitch  Axis 


Figure  30 

Simplified  Block  Diagram  of  Fly-By-Wire  Control  System  -  Roll  Axis 


Figure  31 

Simplified  Block  Diagram  of  Fly-By-Wire  Control  System  -  Yaw  Axis 


control  may  be  provided  by  adding  a  single-degree-of- freed  cm  rate  integrating 
gyro  (RIG)  in  the  command  path  or  by  use  of  am  integrator  in  the  C*  loop. 

This  approach  provides  all-attitude  capability  while  remaining  independent  of 
inertial  platforms  or  attitude  gyros.  The  pilot  command  through,  the  FIG  yields 
a  proportional  C*  response.  The  command  torques  the  RIG  gimbal.  The  KEG  inte¬ 
grates  the  aircraft  rate  response  resulting  in  a  gyroscopic  torque  on  the 
gimbal  thereby  opposing  the  cccmand  torque.  These  two  torques  are  equal  at  the 
commanded  aircraft  rate,  Gimbal  rotation  is  always  very  small  so  that  the  gyro 
can  be  said  to  be  iynchronized  to  the  aircraft  at  all  times.  When  the  pilot 
removes  the  ccmnand,  the  RIG  holds  the  aircraft  at  the  existing  attitude. 

Hence,  there  is  all-attitude  path  control.  Without  canmand  inputs  the  RIG  acts 
as  an  attitude  gyro  by  generating  error  signals  proportional  to  changes  in 
attitude.  The  RIG  actually  does  this  by  integrating  body  rate,  but  the  inte¬ 
gral  of  rate  is  attitude.  Only  two  RIG  are  required;  one  for  the  longitudinal 
axis,  and  one  for  the  lateral  axis.  The  lateral  axis  RIG  is  located  in  the 
roll  cccmand  path,  tut  it  actually  senses  yaw  rate.  This  takes  advantage  of 
the  normal  interaction  between  the  roll  and  yaw  axes  to  simplify  the  control 
system. 

A  comparison  of  the  performance  of  the  C*  cotanand  system  and  integral 
control  of  C*  would  show  that  the  latter  would  act  like  a  neutrally  stable 
airplane.  That  is,  the  aircraft  would  tend  to  stay  in  whatever  attitude  the 
pilot  places  it.  The  adaptive-gain  C*  and  fixed  (lower)  gain  C*  systems 
would  act  less  and  less  like  a  neutrally  stable  airplane.  Integral  control 
provides  excellent  path  control  which  would  be  very  beneficial  to  tracking 
tasks.  The  C*  command  system  would  not  hold  an  attitude  quite  aB  well  which 
would  make  it  more  comparable  to  present-day  systems.  Integral  control  has 
what  some  critics  term  a  serious  handicap.  When  approaching  a  stall  condi¬ 
tion,  it  will  continue  to  maintain  a  fixed  attitude.  This  tends  to  wash  out 
the  mild  buffeting  that  precedes  stall  onset  which  would  ordinarily  alert  the 
pilot.  The  system  could  continue  to  hold  attitude  on  into  the  dangerous  deep 
stall  region.  If  stall  warning  devices  of  some  type  were  not  available  to 
forewarn  the  pilot,  he  could  find  himself  in  deep  trouble  without  realizing 
it.  The  C*  command  system  would  not  have  this  problem  because  the  pilot 
would  notice  the  buffeting  in  time  to  recover.  A  neutrally  stable  airplane 
may  be  objectionable  to  pilots  during  combat  maneuvers  because  of  the  complete 
loss  of  speed  feel.  C*  command  acts  like  an  imperfect  integral  controller 
that  retains  a  suggestion  of  speed  feel  particularly  in  the  fixed-gain  sys¬ 
tem.  This  is  a  subjective  argument  which  bears  verification.  A  decided 
advantage  of  the  C*  comnand  system  is  that  it  does  not  require  the  RIG  which 
is  a  relatively  expensive  and  unreliable  mechanism.  Therefore,  because  of 
its  relative  simplicity  and  apparently  more  natural  feel  characteristics,  the 
C*  command  should  be  used  for  the  basic  fly-by -wire  system.  Integral  control 
should  be  added  for  long-term  attitude  control  in  the  form  of  a  slow  inte¬ 
grator  in  parallel  with  the  command  system  much  like  a  series  automatic  trim 
function.  Fast  integral  control  for  tracking  and  fire  control  can  be  added 
as  required. 

Artificial  feel  implemented  by  the  C*  command  approach  has  several 
advantages  over  other  methods. 

a.  It  provides  nearly  neutral  speed  stability  which  permits  tracking 
during  rapid  speed  changes  without  trim. 
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b .  Aircraft  response  conforms  to  angular  rate  at  low  speeds  and  normal 
acceleration  at  high  speeds. 

c.  System  is  independent  of  airspeed  or  altitude. 

d.  It  provides  good  command  response  while  maintaining  high  gust 
damping. 

e.  It  is  flexible  so  that  signals  from  other  subsystems  can  be  added. 

f.  Feel  is  independent  of  the  aircraft;  therefore,  all  aircraft  of  a 
class  (e.g.,  fighters)  could  have  the  same  feel  and  use  the  same 
components . 

g.  It  utilizes  sensors  which  nearly  always  already  exist  in  the  aircraft 
to  augment  stability.  Therefore,  additional  components  such  as 
q-springs  and  bobweights  are  unnecessary. 

In  the  system  block  diagrams,  the  direct  (backup)  path  parallels  the 
normal  operational  path.  Because  of  the  high  gain  of  the  normal  control  and 
the  relatively  low  gain  of  the  backup  control,  the  normal  control  dominates 
until  it  is  disengaged  because  of  failures.  Presence  of  the  backup  control 
creates  a  small  bias  which  does  not  affect  normal  operation.  The  direct 
control  path  supplies  a  simple  but  sluggish  backup  control  for  the  system 
with  essentially  no  feel  provisions.  It  will  provide  emergency  control  of 
the  aircraft  to  get  the  pilot  back  to  his  base.  Trim  is  applied  either  in 
series  at  the  servo  by  an  electrical  bias  in  parallel,  by  an  actuator  on  the 
control  stick  to  position  the  neutral  point,  and/or  through  a  separate  trim 
actuator  (such  as  to  move  trim  tabs  or  the  horizontal  stabilizer).  The 
pilot's  controller  is  a  spring-centered  stick  with  an  electrical  output  from 
either  position  or  force  transducers.  The  stick  (or  wheel)  may  be  either  a 
conventional  type  which  is  center  located  or  a  small  stick  which  1b  located 
at  one  side.  Minimum  system  redundancy  will  be  either  three  parallel  real 
channels  and  a  model  (simulated)  channel  or  four  parallel  real  channels.  The 
reasoning  behind  this  redundancy  level  is  discussed  in  Section  VI  under 
Tradeoffs . 

The  general  advantages  of  fly -by -wire  control  over  the  conventional 
mechanical  designs  are  summarized  as  follows: 

a.  Improves  control  performance  through  better  dynamic  response 
control  and  the  elimination  of  friction,  backlash,  hysteresis, 
compliance,  inertia 

b.  Smaller  installed  weight  and  volume 

c.  Reduces  total  cost  o^  ownership  including  initial,  maintenance , 
and  logistics  costs 

d.  Better  maintainability  and  logistics  because  of  the  reduction  in 
the  number  of  critical  parts,  easier  access,  and  higher  level  of 
interchangeability  between  aircraft 
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e.  Reduces  vulnerability  to  minor  structural  damage,  maintenance 
errors,  and  battle  damage 

f.  Greater  cockpit  installation  and  orientation  flexibility 

g.  Eliminates  coupling  into  body  bending  modes 

h.  Reduces  the  required  design  effort 

i.  More  flexible  to  design  or  performance  changes 
k.  DEVELOPMENT  OF  FLY-BY-WIRE 

The  preceding  discussion  has  shown  where  fly-by -wire  technology  stands 
today.  Our  present  studies  have  shown  that  a  practical  fly-by-wire  system  is 
within  the  present  state  of  the  art.  However,  a  great  deal  of  reluctance  to 
use  it  exists  because  of  the  lack  of  confidence  in  maintaining  system  integ¬ 
rity  and  because  of  a  lack  of  familiarity  of  design  groups  with  the  available 
components  and  design  techniques.  The  first  logical  step,  therefore,  is  to 
build  an  experimental  laboratory  model  of  a  fly-by-wire  system  to  demonstrate 
its  operation  under  simulated  failures.  This  model  will  also  demonstrate  the 
use  of  state-of-the-art  components  and  the  effectiveness  of  existing  design 
techniques . 

Construction  and  evaluation  of  a  laboratory  experimental  model  of  a 
representative  fly-by-wire  system  will  accomplish  a  number  of  ends.  First, 
it  will  demonstrate  the  systems  operation  and  performance  under  various 
failure  conditions;  second,  it  will  provide  data  to  establish  performance 
requirements;  third,  it  will  provide  a  test  bed  for  testing  other  techniques 
which  may  become  available  during  the  course  of  the  development;  and  fourth, 
it  will  provide  the  data  needed  to  design  future  flightworthy  systems. 

The  next  logical  step  Is  to  convert  an  existing  aircraft  to  fly-by-wire 
using  the  data  from  the  experimental  model.  Then,  by  putting  as  many  flight 
hours  on  it  as  possible,  the  integrity  and  practicality  of  fly-by-wire  can 
be  demonstrated.  Successfully  completing  this  step  should  provide  the 
impetus  to  all,  those  people  in  industry  who  are  waiting  for  in-flight  proof 
of  fly-by-wire  maturity. 

We  are  interested  in  the  capability  of  designing  fly-by-wire  systems 
today.  Hence,  we  want  to  use  as  much  available  and  proven  hardware  as 
possible.  As  shown  in  the  following  sections,  very  little  development  is  re¬ 
quired  except  In  the  actuator  area.  Here  the  prime  concerns  are  the  proper 
application  of  redundancy  and  the  ability  to  prevent  failures  from  adversely 
affecting  system  performance. 
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SECTION  V 


DESIGN  CONSIDERATIONS  AND  SYSTEM  COMPONENTS 


1.  DESIGN  CONSIDERATIONS 

A  wide  selection  of  components  is  available  today  for  use  in  fly-by-wire 
systems.  While  little  doubt  of  this  fact  exists  in  the  industry,  few  people 
are  aware  of  the  choices  and  the  optimum  combinations  in  terms  of  weight, 
volume,  cost,  reliability,  maintainability  performance,  and  power  drain.  To 
determine  which  types  of  components  are  required,  a  number  of  general, 
approaches  to  mechanizing  fly-by-wire  along  with  related  system  consider¬ 
ations  will  be  discussed  first.  Component  types  will  then  be  described. 

One  of  the  first  factors  to  consider  in  establishing  the  approach  to 
mechanizing  a  fly-by-wire  system  is  the  method  of  signal  transmission.  For 
the  immediate  discussion,  the  term  "fly-by-wire"  can  be  considered  a 
catchall  phrase  meaning  any  nonmechanical  technique  for  signal  transmission. 

We  could  Just  as  well  fly  by  fluid  or  light  or  radio.  We  have  already  defined 
fly-by-wire  as  an  electrical  primary  flight  control  system  in  which  vehicle 
motion  i6  the  controlled  parameter.  Fly -by-fluid  is  similarly  defined  as  the 
technique  of  fluidically  transmitting  all  control  signals  from  the  pilot's 
station  to  the  control  surface  actuators.  This  technique  has  the  potential 
advantage  of  not  requiring  electrical  power.  Such  an  approach  was  at  one  time 
considered  for  the  Concorde  SST.  In  a  fly -by-fluid  system,  control  stick 
motion  modulates  a  pressure  control  valve  so  that  it  operates  as  a  position 
transducer,  that  is,  the  output  pressure  is  proportional  to  stick  position. 
While  such  a  transducer  does  not  presently  exist,  little  development  would  be 
required  in  designing  one.  The  pressure  change  is  transmitted  along  a  pair  of 
hydraulic  lines  to  operate  the  servo  control  valve.  Mechanical  feedback 
would  be  used  on  the  actuator.  Several  fluidic  SAS  are  being  developed 
which  could  be  summed  hydraulically  or  an  electrical  SAS  could  be  summed 
through  an  electrohydraulic  valve.  Actuator  monitoring  would  be  hydraulic. 
While  such  a  scheme  appears  to  be  workable,  it  has  several  basic  drawbacks. 
Because  of  the  compressibility  of  hydraulic  fluid,  a  signed  time  delay 
results.  The  delay  time  or  lag  in  a  line  100  feet  long  is  about  24  milli¬ 
seconds  based  on  a  typical  speed  of  sound  in  the  fluid  of  4,200  feet  each 
second.  Because  of  line  reflections,  the  system  could  resonate  at  about  6.6 
hertz.  To  maintain  a  resonable  phase  margin,  the  frequency  response  would 
have  to  be  limited  to  about  4  hertz.  The  acceptability  of  the  actual  limit, 
and  hence  the  fly -by-fluid  technique,  depends  on  the  application.  On  large 
aircraft,  it  may  well  be  unacceptable  because  of  the  very  long  lines  required. 
Other  drawbacks  include  the  weight  of  the  pressure  control  lines  needed  for  a 
redundant  system  which  would  very  likely  be  triplex.  These  lines  are  in 
addition  to  the  actuator  supply  lines.  The  trim  input  transducer  may  require 
development.  It  would  provide  a  control  pressure  bias.  An  acceptable 
artificial  feel  mechanization  would  also  require  development.  In  summary,  the 
fly-1 y-wi re  fluid  technique  would  have  the  advantage  of  not  requiring 
electrical  power,  but  it  has  the  disadvantages  of  requiring  additional 
development  and  having  limited  frequency  response . 


A  fly-by-light  technique  may  also  be  considered  briefly.  Currently 
available  components  require  the  use  of  electrical  transducers  with  signal 
conversion  to  light  for  transmission  along  optical  fiber  bundles .  Recon¬ 
version  to  an  electrical  signal  is  required  before  commanding  conventional 
electrohydranlic  servos.  The  advantages  of  optical  transmission  sure  that 
stray  signal  pickup  and  interference  are  eliminated,  interchannel  isolation 
is  ensured  because  common  paths  or  short  circuits  cemuot  occur,  and  a  very 
high  degree  of  redundancy  is  available  within  the  glass  fiber  bundles.  For 
example,  a  l/8-inch  bundle  contains  about  70,000  fibers,  each  0.0005  inch  in 
diameter.  These  very  small  fibers  are  very  flexible  and  strong.  Fiber 
"'undies  are  currently  used  in  some  aircraft  for  observing  in  flight  (from 
the  cabin)  the  raising  and  lowering  of  the  landing  gear  or  the  operation  of 
fuel  cells  and  control  surface  actuators.  The  disadvantages  include  the 
relatively  high  cost  of  fiber  bundles  of  about  a  dollar  for  each  foot  and  the 
very  high  optical  attenuator  along  the  bundles.  The  attenuation  is 
approximately  50  percent  in  6  feet.  In  this  case,  pi  lse-mxodulated  signals 
would  be  desirable.  As  will  be  shown  later,  pulBe  or  binary  signals  of  any 
type  are  undesirable.  Since  the  high  signal  attenuation  is  also  undesirable, 
optical  transmission  can  be  ruled  out. 

The  fly-by-radio  technique  transmits  control  signals  via  v-f  energy  thus 
eliminating  wires  altogether.  However,  this  technique  cam  be  ruled  out 
inmediately  because  of  the  possibility  if  interference  with  the  ship’ 6  instru¬ 
ments  and  radio  and  radar  equipment  and  because  the  many  bulkheads  within  the 
airframe  effectively  prevent  signal  continuity. 

The  conclusion  of  this  discussion  is  that  electrical  signal  transmission 
is  the  desired  technique  within  the  present  state  of  the  au*t  in  control 
system  design.  The  next  importeuit  factor  to  consider  is  the  signal  format  or 
type  6ince  this  grossly  affects  or  is  affected  by  the  available  equipment 
and  its  complexity.  The  signal  type  can  be  divided  into  five  categories. 

a.  DC 

b.  AC 

c.  Pulse  modulation 

d.  Digital 

e.  Multiplex 

DC  and  suppressed  carrier  ac  are  the  only  commonly  used  signal  forms  in 
aircraft  control  systems.  All  available  servovalves  require  dc  drive  cur¬ 
rent.  Further,  signal  shaping  and  Interchannel  summing  are  best  done  with 
dc.  Shaping  with  ac  signals  requires  a  supply  frequency  that  i6  much  more 
stable  than  is  available  in  aircraft  supplies.  For  a  similar  reason,  summing 
signals  from  channels  powered  by  different  supplies  is  difficult  if  not 
impossible  because  the  supplies  are  difficult  to  hold  in  phane  let  alone  to 
hold  at  the  same  frequency.  AC  amplifiers  are  commonly  used  to  eliminate  the 
effects  of  amplifier  drift,  but  amplifiers  are  now  being  built  having  nearly 
the  drift  characteristics  of  an  analog  computer  amplifier.  For  example, 
drift  can  be  readily  maintained  within  ±0.25  percent  of  full  scale  output 
over  the  temperature  range  -131*F  (-55*C)  to  +255*2*F  (+125*C)  with  ±0.05 
percent  capability  available.  AC  electronics  are  employed  in  fail-passive 
designs  to  eliminate  the  effects  of  hardover  failures.  Failures  produce 
large  dc  outputs  to  which  the  ac  circuits  are  insensitive.  Fail-passive 
design  was  discussed  for  reliability  veasons  in  Section  III.  Finally,  since 
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inductile  transducers  are  preferred,  sont  ac  electronics  are  required  to 
process  their  outputs.  Although  other  signal  formats  have  advantages  of 
noise  immunity  or  circuit  simplicity,  their  overall  complexity  plus  the 
functional  simplicity  of  the  fly-by-wire  system  makes  the  use  of  other  than 
simple  dc  or  suppressed  carrier  ac  difficult  to  justify.  With  the  possible 
exception  of  digital  signals,  all  other  formats  require  complex  conversion 
equipment  at  the  transducers  said  other  inputs  and  again  at  the  servos.  Such 
signal  formats  include  frequency  modulation,  various  forms  of  pulse  modu¬ 
lation  (e.g.,  rate,  width,  amplitude,  code  and  delta),  and  forms  of  multi¬ 
plexing  (e.g.,  frequency  pnd  time).  Furthermore,  even  simple  signal  shaping, 
such  as  a  lead  or  lag  function,  is  often  difficult  to  perform  without 
additional  circuit  complexity- or  reconversion  to  dc.  Digital  signal  formats 
(wnole  word  or  incremental)  could  be  applicable  where  digital  transducers  and 
acutators  are  available  because  no  conversion  equipment  would  be  required. 
Signal  shaping  still  requires  excessive  complexity  for  the  whole  word  format 
but  not  for  incremental  computation.  In  either  case,  a  practical  digital 
servoactuator  is  not  available  within  ■'■he  current  state  of  the  art.  Present 
digital  actuator  designs,  which  are  being  developed  bv  a  number  of  companies, 
tend  to  be  large  and  complex.  We  conclude  then  that  both  dc  and  suppressed 
carrier  ac  should  be  used  in  fly -by-wire  systems  because  system  complexity 
and  cost  are  minimized,  and  reliability  is  maximized.  DC  signals  should  be 
used  for  signal  shaping,  summing,  and  for  the  servovalve  drive.  AC  signals 
should  be  used  in  conjunction  with  transducers  and  in  fail-passive  circuits. 

To  determine  the  components  required  for  a  typical  fly-by -wire  control 
system,  we  can  refer  to  the  block  diagram  shown  in  figure  32  which  might 
result  from  a  preliminary  design.  The  components  can  be  categorized  into  the 
control  stick,  transducers,  transmission  line,  summing  Junctions,  electronics, 
actuators,  artificial  feel  sensors,  and  the  trim  actuator  auid  switches.  The 
hydraulic  and  electrical  power  supplies  are  excluded.  Table  I  indicates  the 
developmental  status  of  the  veirious  types  of  transducers  and  sensors  that  sure 
applicable  to  fly-by-wire  systems.  Table  II  summarizes  the  important  trans¬ 
ducer  characteristics.  Table  III  shows  the  performance  requirements  for  the 
transducers  and  sensors. 

2.  CONTROL  STICK 

a.  Introduction 

A  control  stick  may  be  a  center,  stick  or  wheel  or  a  small  Bidestick 
hand  controller.  The  selection  of  one  of  these  types  lies  basically  in  the 
realm  of  human  factors  and  depends  heavily  on  the  desired  cocxpit  organi¬ 
zation.  The  following  discussion  describes  sidestick  controllers  because 
they  enhance  the  benefits  of  fly-by-wire  systems  more  than  center  sticks  or 
wheels  and  because  they  maty  very  well  not  be  an  familiar  to  the  reader. 

Sperry  does  not  contend  that  center  sticks  or  wheels  should  not  be  employed 
in  fly-by-wire  systems,  but  they  eure  less  de  sir  stole  because  of  their  larger 
size  and  weight  end  their  relative  position  in  the  cockpit.  The  discussion 
considers  the  type  of  stick,  articulation,  cross  coupling,  .trim  control,  end 
parameter  adjustment.  The  design  of  a  typical  sidestick  controller  is  also 
presented.  The  design  is  based  on  Sperry's  extensive  background  and  on  the 
results  of  pre\  ious  military  development  programs  in  this  eurea.  (Refer  to 
references  19  through  25*) 
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Figure  32 

General  Fly-By-Wire  Configuration 
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Y  OF  TRANSDUCER  AND  SENSOR  TYPES 


TABLE  n 

SUMMARY  OF  COMPONENT  CHARACTERISTI 


Component 

Signal 

Type 

Power 

Level 

Size 

Weight 

Cost 

(dollars) 

X  6 

Each  10°  hr 

Control  Stick 
Position  Transducer 

LVCT 

ac 

Low 

1/4  D  x  7/16  in.  L 
to 

7/8  D  x  14  in.  L 

1  to  5  oz 

50  (short) 

100  to  300 
(long) 

12 

High 

3  D  x  4  in.  L 

15  lb 

Synchro 

ac 

Low 

Size  8,  3/4  in.  D 

1  to  3  oz 

40  to  100 

8 

Potentiometer 

dc 

ac 

Low 

1  to  6  oz 

5  to  25 

100  to  200 

Digital  Encoder 

binary 

code 

Low 

2  ±  1/4  in.  D 

1-1/4  to  3  in.  L 

1/4  to  1  lb 

200  to  600 

100 

8,  11  type 

Control  Stick 

Force  Transducer 

E-Plckoff  on  a 
Machined  Spring 

ac 

Low 

1-1/2  x  14  In. 
series  control 
link  3  D  x  11  in. 
link  in  column 

2.5  lb 

2.7  lb 

800  to 

1,000  for 
each  axis 

12 

Fall  or  Wire  Strain 
Gage  on  Load  Beam 

ac 

dc 

Low 

1  to  10  in.^  for 
load  beam 

1  to  2  lb 
for  load 
beam 

800  to 

1,000  for 
eaeh  axis 

24  for  each 
bridge 

Semiconductor 

Strain  Gage  on 

Load  Beam 

ac 

dc 

Low 

1  to  10  in.^  for 
load  beam 

1  to  2  lb 
for  load 
beam 

800  to 

1,000  for 
each  axis 

24  for  each 
bridge 

TABLE  n 

SUMMARY  OF  COMPONENT  CHARACTERISTICS 


Weight 

Cost 

(dollars) 

X  A 

Each  10°  hr 

1  to  5  oz 

50  (short) 

12 

15  lb 

100  to  300 
(long) 

1  to  3  oz 

1+0  to  100 

8 

1  to  6  oz 

5  to  25 

100  to  200 

1 /4  to  1  lb 

200  to  600 

100 

2.5  lb 

2.7  lb 

800  to 

1,000  for 
each  axis 

12 

1  to  2  lb 
for  load 
beam 

800  to 

1,000  for 
each  axis 

24  for  each 
bridge 

1  to  2  lb 
for  load 
beam 

800  to 

1,000  for 
each  axis 

24  for  each 
bridge 

Tensile 
Strength^ 
psi  x 


10-3 


Comments 


Includes  induction  potentiometer,  linear  trans¬ 
former,  linear  synchro. 

Conductive  plastic  has  best  life. 


1  turn  =  100  to  620  counts. 

Requires  10  KC  to  200  KC  interrogation  signal 
plus  electronics  for  readout. 


Experience  shows  current  technology  can  produce 
more  repeatable  E-pickoff  than  strain  gage 
type.  Used  in  several  systems. 


12  volts  excessive,  3  volts  output,  0.5  percent 
full-scale  linearity,  0.2  percent  full-scale 
null,  maximum  deflection  0.03  inch,  300  pounds 
overload  capacity. 

Deposited  type  eliminates  bonding. 
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TABLE  II  (coat) 

SUMMARY  OF  COMPONENT  CHARACTERISTICS 


Component 

Signal 

Type 

Power 

Level 

Size 

Weight 

Cost 

(dollars) 

Each  106  hr 

Te 

St 

psl 

Sunning  Junction 

Transistor 

Amplifier 

ac 

dc 

pulse 

Low 

TO -5  or 

1/4  x  1/4  in. 
flatpack 

Negligible 

25  to  50 

1 

1  x  1  x  l/2  in. 

1  oz 

40  to  200 

3  to  6 

Transformer 

ac 

Low 

0.04  to  1  in. ^ 

0.1  to  1  oz 

5  to  10 

0.1  to  1 

High 

1  to  20  lbs 

5  to  50 

0.1  to  2 

Optoelectronic 

Transistor 

ac 

dc 

pulse 

Low 

TO- 5 

Negligible 

25  to  125 

1 

Adder/Regi st er 

binary 

Low 

1  to  10 

TO-5  or 

1/4  x  l/4  in. 
flatpack 

Negligible 

60  to  100 

0.1  to  1 

Fluidic 

Amplifier 

dc 

binary 

Low 

40  to  200 

1  to  6 

Resolver 

(Modified) 

ac 

Low 

Size  8,  3/4  in.  D 

1.5  oz 

40  to  100 

8 

Transmission  Line 

Electrical.  Wire 

Stranded  copper 

ac 

dc 

pulse 

Low 

or 

High 

#80 

11  lb  each 
10~3  feet 
(shielded) 

20  each 

10^  feet 

38 

Reinforced  copper 

50 

Copper-clad  steel 

5  lb  each 

10J  feet 
(unshielded) 

100 

TABLE  II  (cent) 

SUMMARY  OF  COMFOtraST  CHARACTERISTICS 


Height 

Cost 

(dollars) 

X  6 

Each  10°  hr 

Tensile 
Strength 
psi  x  10“3 

Comments 

legligible 

25  to  50 

1 

Microcircuit. 

L  oz 

1*0  to  200 

3  to  6 

Discrete  components. 

).l  to  1  oz 

5  to  10 

0.1  to  1 

L  to  20  lbs 

5  to  50 

0.1  to  2 

legllgible 

25  to  125 

1 

legligible 

60  to  100 

0.1  to  1 

40  to  200 

1  to  6 

..5  oz 

40  to  100 

8 

Used  with  fail-passive  servo  only.  Has  two 
orthogonal  stator  windings  and  one  rotor 
winding. 

l1  lb  each 
-0”3  feet 
’shielded) 

20  each 

103  feet 

38 

50 

Three  strands  stainless  steel  and  16  strands 
copper. 

i  lb  each 
.03  feet 
unshielded) 

100  to  150 

Resistivity  two  and  one-half  times  copper. 
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Component 


Signal  Power 
Type  Level 


I 


ransmission  Line 


cont 


Optical  Fiber 
Bundle 


pulse  Low  0.03  to  0.4  in. 

diameter 


Hydraulic  Line 


dc  Low 

pulse  or 

High 


Hydraulic 


Servovalve 


Jet-Pipe  with  Power  dc 


Spool  (flow 
control) 


Jet-Pipe,  Single- 
Stage  (pressure 
control) 


Low  l/4  to  l/2  in. 

or  0 . D • 


Flapper  Nozzle  with  dc 
Power  Spool  (flow  8  to 

control)  100  ma 


High  1-1/2  x  1-1/2  x 
1-1/2  in.  to 
2  x  2  x  3  in. 


8  to 
100  ma 


High  2  x  2  x  2  in. 


dc 

8  to 
100  ma 


2  x  2  x  2  in. 


pulse  High  2  x  2  x  3  in. 
12  ma 


to  500 


TABLE  II  (cont) 


SUM*  (ARY  OF  COMPONENT  CHARACTER  IS 


y  .  .  .  Cost  A.  , 

811  (dollars)  Each  10°  hr 


0.4  lb 
0.6  lb 


0.6  lb 


0.5  lb 


300  to  500  250  to  500 
A  active  = 

50  to  100 


300  to  500  250  to  500 
A  active  = 
25  to  75 


300  to  500  100  to  200 
A  active  = 
0.3 


200  to  400  N/A 


Acceleration 

Switching 


0.5  to  1.0 
lb 


TABLE  II  (cont) 

SUMMARY  OF  COMPONENT  CHARACTERISTICS 


f eight 

Cost 

(dollars) 

Each  106  hr 

Tensile 
Strength 
psi  x  10"3 

Consents 

<l/ft 

Transmission  loss  10  percent  per  foot.  Fiber 
diameter  10  microns  (0.0005  in.)  to  75  microns 
(0.003  in.).  l/8  in.  diameter  bundle  has  about 

70,000  fibers.  Can  be  coherent. 

k  lb 

5  lb 

300  to  500 

250  to  500 

X  active  = 

50  to  100 

Standby  leakage  flow  generally  less  than 
Jet-pipe;  has  higher  pressure  gain. 

6  lb 

300  to  500 

250  to  500 

X  active  = 

25  to  75 

Jet-pipe  is  much  less  susceptible  to  clogging 
than  flapper  nozzle. 

5  lb 

300  to  500 

100  to  200 

X  active  = 
0.3 

Essentially  no  moving  parts;  Jet-pipe  acts  like 
cantilever  spring.  Used  in  fail-passive 
actuator. 

5  to  1.0 

200  to  kOO 

n/a 
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b.  Moving  Versus  Rigid  Stick 

The  possibility  of  using  a  pure  force-sensing  (rigid)  stick  is 
attractive  in  that  problems  with  pivot  location  and  articulation,  discussed 
in  subsequent  paragraphs,  are  nonexistent.  Development  work  by  the  military 
has  shown  that  pilot  performance  with  rigid  stick  controls  is  acceptable  for 
many  tasks;  however,  it  is  inferior  to  that  with  a  moving  stick  particularly 
for  high-demand  tracking  tasks. 

c.  Controller  Size  and  Shape 

Side  controller  evaluation  programs  have  studied  various  stick 
shapes  and  sizes  from  conventional  large  center  stick  grips  to  low-force- 
gradient  "pencil  sticks"  of  l/8-inch  diameter.  Flat  headrest  type  control¬ 
lers  using  the  tracking  ball  principle  have  also  been  evaluated.  Although 
accustomed  to  large  grips,  pilots  frequently  criticize  their  use  in  side 
control  applications  in  which  the  rotational  pivot  is  near  the  base  of  the 
grip;  test  results  verify  that  more  precise  control  is  possible  with  the  use 
of  a  stick  of  diameter  more  compatible  with  the  limited  motion  of  the  side 
stick.  Use  of  a  pencil-type  control  is  impractical  not  only  because  it 
would  at  present  be  a  radical  departure  from  the  ordinary  but  also  because 
the  stick  must  provide  for  trim  and  interlock  controls. 

Another  frequent  objection  to  the  use  of  conventional  sticks  as  side 
controllers  is  the  necessity  of  moving  the  hand  upward  from  its  normal 
position  to  reach  the  trim  controls.  A  grip  having  a  moderate  diameter  and 
height  would  meet  the  requirement  for  precise  control  and  provide  adequate 
volume  for  incorporating  the  necessary  switches.  A  detailed  component 
description  of  a  practical  stick  grip  is  provided  in  paragraph  V.2.g. 

d.  Articulation 

The  selection  of  pivot  location  for  a  side  controller  has  been 
critical  to  the  success  of  previous  designs.  The  simplest  mechanization  is 
to  pivot  both  pitch  and  roll  (and  yaw  in  a  three-axis  controller)  below  and 
near  the  base  of  the  stick  grip.  This  design  requires  translational  rather 
than  rotational  hauid  motior-,  this  has  been  considered  disadvantageous 
particularly  in  a  high-g  environment  in  which  +"he  forearm  is  by  necessity 
restrained.  In  three-axis  controllers  of  this  simple  design,  yaw-roll  cross 
coupling  is  a  particular  problem  which  cam  be  only  partially  overcome  by  the 
use  of  high  detent  forces  or  by  providing  free  'arm  motion. 

Various  gimbaling  techniques  have  been  developed  to  overcome  these 
problems.  Wrist-pivot  controllers  in  which  roll  and/or  pitch  motions  are 
gimbaled  back  to  the  wrist  have  been  studied.  Pitch  rotation  about  the  grip 
center  and  roll  rotation  about  the  axis  of  the  forearm  as  well  as  double-link 
(articulated)  sticks  have  also  been  studied.  Additional  difficulties  have 
arisen  with  each  complexity;  mass  balemclng  becomes  more  complex,  friction 
and  lost  motion  increase,  use  of  new  muscles  is  required,  wristlock  or 
awkward  control  is  observed.  The  use  of  wrist-pivot  longitudinal  cyclic 
control,  for  example,  results  in  an  up-down  hand  motion  effect  rather  than 
fore-aft,  requiring  some  retraining  on  the  part  of  the  pilot. 
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Much  benefit  has  been  derived  from  these  programs;  however,  they 
indicate  that  as  long  as  controller  motion  is  restricted  to  certain  limits 
the  simple  pivot  technique  is  best  for  applications  such  as  the  one  in 
question.  Even  the  Gemini  rotational  side  controller  has  evolved  to  a 
relativel’  simple  design.  Therefore,  a  short-throw,  simply  pivoted  control¬ 
ler  that  is  integral  with  the  armrest  and  uses  as  broad  handrest  at  the  base 
of  the  grip  should  be  used.  With  the  elbow  on  the  armrest  and  the  heel  of 
the  hand  resting  on  the  stick,  the  rotational  and  slight  translational  hand 
motions  will  be  natural  and  analogous  to  current  practice  of  resting  the  arm 
on  the  right  leg  while  using  the  center  stick. 

The  controller  should  be  provided  with  dual  force  gradients  in  both 
roll  and  pitch  to  meet  the  feel  requirements  as  discussed  in  Section  III. 
Control  motions  within  the  range  of  normal  operation  have  a  relatively  low 
force  gradient;  beyond  this  range,  soft  stops  engage  and  a  higher  force 
gradient  is  provided  to  the  limit  stops  at  the  maximum  stick  throw. 

e .  Trim  Control 

The  side  controller  normally  includes  a  short-throw,  four-way  roll/ 
pitch  beep  trim  switch  at  the  top  of  the  stick.  Location  of  the  trim  control 
has  not  proved  very  satisfactory  in  several  previous  side  controllers  because 
the  pilot  had  to  change  hand  position  to  actuate  the  control.  The  hand 
should  not  have  to  move  up  the  stick  to  operate  the  trim  switch;  switch 
operation  should  not  cause  inadvertent  stick  motions,  and  vice  versa. 

The  question  of  beep  versus  wheel  trim  always  arises,  and  no  single 
design  has  proved  universally  satisfactory.  The  current  tendency  particu¬ 
larly  in  high-performance,  fixed-wing  aircraft  is  toward  wheel  (displacement) 
trim  (X-15,  F-8) .  For  helicopter/VTOL  application,  however,  beep  trim  is 
more  satisfactory. 

In  present-day  aircraft,  retrimming  is  accomplished  as  follows.  As  a 
result  of  a  change  in  flight  condition,  the  pilot  finds  himself  holding  a 
constant  force  on  the  stick,  displaced  from  trim  reference  position.  He 
actuates  the  trim  switch,  driving  the  magnetic  brake/trim  actuator  to  shift 
the  zero-force  trim  reference  point  toward  the  new  stick  position.  His  stick 
force  reduces  at  a  constant  rate.  When  he  feels  the  force  entirely  relieved, 
he  stop ,  trimming,  and  a  new  trim  reference  position  is  therefore  established. 
This  technique  results  in  smooth  readjustment  of  trim  without  attitude 
oscillation. 

Using  a  side  controller  without  mechanical  trim  feedback  to  the 
stick,  the  pilot  has  to  return  the  stick  position  to  center  while  retrimming. 
With  a  wheel-type  trim  control,  the  pilot  probably  will  have  difficulty 
adjusting  the  trim  wheel  continuously  and  smoothly  and  moving  the  stick  at 
the  same  time.  Attitude  oscillations  will  probably  result.  With  beep  trim, 
precise  control  of  the  trim  switch  is  not  required;  actuation  of  the  trim 
switch  requires  only  that  the  pilot  move  the  stick  at  a  constant  rate  toward 
neutral.  Since  this  rate  is  the  same  at  all  flight  conditions,  the  pilot 
should  readily  learn  how  to  retrim  without  causing  oscillations.  This 
technique  is  more  closely  related  to  present  practice  than  would  be  the  use 
of  a  wheel  trim  control. 
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A  block  diagram  in  figure  33  shows  how  the  trim  system  functions. 

For  simplicity,  the  figure  shows  only  one  redundant  channel  of  one  axis  and 
excludes  safety  monitoring.  Actuation  of  the  momentary  trim  switch  drives 
the  integrator  at  a  constant  rate;  the  change  in  integrator  output,  up  to 
the  trim  limit  stops,  is  proportional  to  the  time  the  switch  is  held  down. 
Trim  output  then  passes  to  the  servo  amplifier  where  it  sums  with  the  stick 
position  signal.  Trim  output  should  also  be  displayed  on  a  cockpit  trim 
meter  for  pilot  monitoring  Use  of  a  cockpit  trim  switch,  as  shown,  is 
suggested  to  provide  two  functions:  automatic  trim-to-neutral  for  preflight 
check  list,  and  trim  cutout  in  event  of  trim  failure. 

The  trim  system  should  be  fail-operational  and  fail-safe.  This 
feature  is  compatible  with  the  fail-safe  philosophy  for  SAS  and  related 
subsystems,  and  it  is  an  improvement  over  the  conmonly  nonredundant  trim 
systems.  Prevention  of  runaway  trim  by  the  fail-safe  monitoring  is  often 
essential  to  the  safety  of  the  aircraft;  although  loss  of  trim  is  less 
critical. 

f.  Requirements  for  Adjustability 

The  side  controls  and  armrests  should  provide  adequate  adjustments 
to  accommodate  the  anthropometrical  variations  among  pilots.  Sperry  has 
previously  designed  an  elaborate  study-program  side  controller  which  also 
provided  simple  in-flight  adjustment  of  force  gradient,  detent  force,  and 
damping.  From  this  and  other  programs  generally  acceptable  specifications 
for  these  parameters  have  resulted.  Therefore,  a  highly  flexible  design 
would  be  unnecessarily  complex.  Selection  of  stick  characteristics  and 
adjustment  range  can  be  based  on  results  from  these  previous  military  pro¬ 
grams;  typical  specifications  are  provided  in  the  following  sections. 

g.  Typical  Side stick 

A  typical  fly-by-wire  sidestick  controller,  shown  in  figure  3^* 
provides  quadruple  output  signals  proportional  to  the  displacement  of  the 
stick  grip  from  the  neutral  position  in  both  the  longitudinal  and  lateral 
axes.  In  addition,  a  four-position  trim  switch,  a  pushbutton  interlock 
switch,  and  a  trigger  switch  are  provided  at  the  top  of  the  stick  grip. 

This  sidestick  controller  includes  an  integral  right-hand  armrest  for  the 
pilot' 8  seat. 

The  sensor  design  consists  of  a  two-axis  glmbal  system  with  con¬ 
ventional  coil  springs  for  primary  spring  restraint.  Two  separate  spring 
rates  are  provided  in  all  axes  of  control.  A  fairly  light  spring  rate  is 
provided  during  the  initial  displacement  of  the  grip  and  a  stiffer  spring 
rate  is  provided  during  the  last  segment  of  grip  movement.  The  grip  angle 
where  the  stiffer  spring  rate  is  contacted  is  *10  degrees  in  the  pitch  axis 
and  ±7  degrees  in  the  roll  axis. 

The  controller  Includes  a  padded  elbow  rest  which  is  adjustable  fore 
and  aft.  The  elbow  rest  is  lightly  spring  loaded  to  the  full  forward  posi¬ 
tion  and  adjustment  is  made  by  depressing  the  adjustment  pin,  moving  the  rest 
rearward  to  the  desired  position,  and  releasing  the  adjustment  pin.  The  rest 
will  remain  locked  in  this  position  until  readjusted. 


Figure  33 
Trim  Technique 


Figure  34 

Side stick  Controller 


The  hand  grip  is  designed  specifically  for  sidestick  controller 
applications.  The  grip  is  smaller  in  diameter  than  a  conventional  center 
stick  grip,  and  provides  a  deeply  contoured  thumb  rest  at  the  hack  of  the 
grip  for  applying  precise  forward  stick  motions  and  conventional  finger 
molds  for  applying  aft  motions.  The  four-position  trim  switch  and  the  push¬ 
button  auxiliary  switch  are  located  on  each  side  of  the  thumb  indentation. 

The  pushbutton  switch  is  located  on  the  left-hand  side  of  the  thumb  inden¬ 
tation  and  the  trigger  switch  is  located  under  the  forefinger  position.  An 
access  plate  is  located  at  the  top  of  the  stick  to  provide  access  to  the  trim 
and  interlock  switches. 


The  stick  grip  is  mass-balanced  to  prevent  torquing  moments  about  the 
pivot  points  during  g- loading;  damping  is  provided  in  all  axes  of  control. 

The  selection  of  force  gradients,  pivot  location,  grip  shape,  grip  neutral 
position,  displacement  angles,  and  switch  locations  resulted  from  several 
military  development  programs  which  established  these  parameters. 

The  mechanical  performance  characteristics  are  shown  in  table  IV. 


TABLE  IV 


fECHANICAL  fEHPOEMANCE  CHARACTERISTICS  OF  THE  SIDESTICK  CONTROLS  R 


Characteristic 

Performance 

Grip 

*15  deg  pitch 
*12  deg  roll 

Pitch  Force  Gradient 

0.7  lb/deg  for  10  deg 

1.5  lb/deg  from  10  to  15  deg 

Roll  Force  Gradient 

!  0.3  lb/deg  for  7  deg 

0.9  lb/deg  from  7  to  12  deg 

Grip  Neutral  Position 

15  deg  forward  (adjustable) 

8  deg  inboard  (adjustable) 

Friction  at  Pressure  Point 

0.2  lb  (max)  at  3  g 

Mass  Unbalance 

8  in.-oz  at  3  g  (max) 

Damping 

l/4  sec  from  first  stop  to  neutral 
no  overshoot 

Pressure  Point  to  Pivots 

3  in. 

Detent  Forces 

0.75  lb  both  axes 
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Elbow  rest  adjustment 
range  from  pressure  point 


12,5  to  15.5  in 


3 .  TRANSDUCERS 


Transducers  convert  mechanical  motion  or  force  into  proportional 
electrical  signals.  They  are  used  for  control  stick  inputs,  for  actuator 
feedback  and/or  monitoring  and  possibly  for  flap  position  or  wing  sweep 
position  indication.  Of  primary  concern  are  the  control  stick  and  actuator 
transducers.  Two  classes  of  transducers  can  be  employed  on  the  control 
stick:  force  and  position.  A  relationship  exists  between  the  applied  stick 
force  and  stick  position  for  commands  at  a  given  flight  condition.  The 
relationship  depends  on  the  force  and  position  cues  that  pilots  prefer  for 
various  flight  conditions.  For  example,  at  high  speeds,  the  force  cues 
predominate  and  the  pilot  likes  a  sensitive  stick;  at  low  speeds  (approach) 
position  cues  predominate  and  a  loose  stick  is  preferred.  As  long  as  the 
proper  relationship  is  maintained,  either  force  or  position  transducers  can 
be  employed.  Employing  both  i_>  an  unnecessary  complexity  because  stick  com¬ 
pliance  can  satisfy  the  required  relation.  Two  types  of  sidestick  control¬ 
lers  have  been  employed.  The  first  is  a  conventional  gimballed  stick  which 
has  a  centering  spring  and  uses  position  transducers.  The  other  is  a  force 
stick  which  is  firmly  attached  to  its  base  (i.e.,  nongimballed)  and  uses 
force  transducers  mounted  on  a  compliant  member  near  the  base.  The  com¬ 
pliance  may  allow  no  motion  or  large  deflections.  The  gimballed  stick  is 
more  popular  because  of  the  motion  cues  that  it  supplies  at  low-Q  flight 
conditions. 

Two  types  of  force  transducers  are  in  use  today.  Both  hacve  low  power 
output  suitable  for  signal  use  only.  The  first  type  employs  an  E-core 
transformer  pickoff  or  an  LVBT  (linear  variable  differential  transformer) 
position  transducer  to  measure  the  deflection  of  a  calibrated  spring.  The 
spring  is  very  stiff  and  is  used  as  a  series  link  with  the  applied  force  for 
direct  measurement.  It  may  also  measure  a  fixed  fraction  of  the  applied 
force.  The  output  is  linear  to  within  ±2  to  5  percent  of  full  scale  over 
the  temperature  range.  Temperature  compensation  is  difficult  because  the 
thermal  dependence  is  nonlinear.  The  position  transducers  are  inductive 
devices  having  ac  outputs.  Both  are  designed  to  measure  the  very  small 
deflections  which  are  typically  ±0.010  inch.  Potentiometers  are  not 
suitable  because  they  introduce  small  deadzones  due  to  contact  friction. 

The  second  type  of  force  transducer  enploys  a  strain  gage  bridge  which 
is  bonded  to  a  strain  member  to  measure  the  strains  induced  by  an  input. 

Hie  member  usually  transmits  a  small  fixed  fraction  of  the  force,  but  it  may 
also  transmit  the  full  force.  Redundancy  is  very  easy  to  implement  since  a 
gage  might  typically  be  a  few  tenths  of  an  inch  on  a  side.  Strain  gage 
excitation  might  be  ac  or  dc.  Linearity  and  gradient  stability  can  be  held 
to  within  0.1  to  1.0  percent  of  full  scale.  Temperature  compensation  is 
relatively  simple  to  obtain  because  the  thermal  dependence  is  linear.  Two 
potential  problems  of  strain  gages  cause  a  high  failure  rate:  signal-to- 
nolse  ratio  and  bonding.  The  best  strain  gages  available  today  are  metal 
foil.  The  signal -to-noise  ratio  of  foil  and  wire  gages  is  very  low.  To 
provide  a  usable  output,  they  are  operated  near  the  endurance  limit  of  the 
gage  material,  which  leads  to  a  high  failure  rate,  or  a  high  gain  stage  of 
anpliflcation  is  used  or  both.  Semiconductor  strain  gages  solve  this  problem 
because  they  hove  a  much  larger  output.  Their  resistance  is  high  and  the 
change  with  stress  is  large.  Foil  gage  outputs  are  in  millivolts;  semicon¬ 
ductor  gage  outputs  are  in  volts. 
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The  second  problem  is  that  of  properly  bonding  the  gage  to  the  strain 
member.  Poor  bonding  causes  null  creep,  long  term  drift,  and  poor  operation 
at  the  temperature  extremes.  Bonding  technology  has  developed  tremendously, 
but  the  human  element  has  prevented  elimination  of  the  problem.  The  recent 
breakthrough  in  depositing  semiconductor  gages  directly  onto  silicon  strain 
members  will  essentially  solve  the  problem. 

The  choice  today  between  the  two  types  of  transducers  would  depend  on 
the  tradeoff  between  the  size  and  reliability  of  a  redundant  transducer. 

The  inductive  pickoff  and  spring  occupies  a  minimum  of  several  cubic  inches 
apiece.  This  normally  precludes  installing  redundant  transducers  inside  a 
control  stick  since  at  least  three  are  needed  in  each  axis.  They  would  have 
to  be  externally  mounted.  Foil  strain  gages  have  at  least  three  times  the 
failure  rate  of  the  spring  type  (A  >30  versus  10  failures  each  10°  hours). 
The  initial  costs  are  about  equal.  Therefore,  in  a  center  stick,  the  in¬ 
ductive  pickoff  and  spring  should  be  used,  but  in  a  sidestick  strain  gages 
should  be  used.  Semiconductor  strain  gages  will  be  at  least  as  reliable  as 
the  inductive  pickoff  and  spring.  Therefore,  when  these  gages  become 
available  in  the  near  future,  they  should  be  used  in  either  application. 

Four  types  of  position  transducers  are  available:  the  potentiometer, 
synchro,  LVDT,  and  digital  encoder.  The  familiar  potentiometer  is  a 
variable  resistance  device  that  can  be  energized  by  either  ac  or  dc  power. 

It  is  available  in  nearly  any  size,  shape,  and  resistance.  Its  output  can 
be  shaped  to  a  specified  nonlinear  function  with  either  linear  or  rotary 
output.  While  a  potentiometer  can  be  made  to  control  relatively  large  power 
levels  (such  as  a  few  watts),  it  is  generally  best  suited  for  signal  power 
level  outputs  because  of  the  large  internal  losses.  The  resolution  of  wire 
wound  potentiometers  is  limited  by  the  wire  spacing;  the  resolution  of  com¬ 
position  potentiometers  is  unlimited.  The  newer  conductive  plastic  types 
are  preferred  because  of  their  higher  reliability  although  signal  noise  may 
be  a  problem.  The  reliability  of  potentiometers  is  relatively  poor;  a 
typical  failure  rate  is  at  least  100  each  10°  hours.  Nearly  all  of  this 
rate  is  due  to  the  action  of  the  wiper  contacts  which  are  very  susceptible 
to  vibration  and  wear.  Cost  ranges  from  $5  to  $25. 

The  synchro  of  concern  here  goes  by  many  names:  induction  potentio¬ 
meter,  linear  transformer,  linear  synchro,  rotary  transformer,  or  rotary 
variable  differential  transformer.  The  device  has  a  single  rotor  primary 
and  a  single  stator  secondary  winding  which  is  normally  wound  to  provide  a 
linear  output  with  rotation  rather  than  sinusoidal .  Being  a  transformer, 
the  windings  are  electrically  isolated  and  the  resolution  is  practically 
unlimited.  For  reliability  a  brushless  synchro  should  be  used.  The  rotor 
input  comes  through  the  rotor  shaft  via  flexible  leads  rather  than  via 
sliprings,  and  rotor  motion  is  stopped  short  of  ±90  degrees  to  avoid 
ambiguity  and  lead  twisting.  Excitation  is,  of  course,  400  hertz  at  either 
2 6  or  115  volts.  Input  power  ranges  from  0.1  to  1.0  watts.  Linearity  is 
commonly  ±0.5  percent  of  full  scale.  Synchros  are  sized  according  to  out¬ 
side  diameter.  The  smallest  practical  and  proven  size  is  a  size  8  which  has 
a  0.75  inch  diameter.  Its  weight  is  36  grams.  A  smaller  size  5  is 
available  with  a  0.5  inch  diameter,  but  its  reliability  is  as  yet  unproven. 
Output  power  level  is  small  being  measured  in  milliwatts.  Cost  ranges  from 
$40  (in  large  quantities)  to  $80.  Synchro  reliability  is  the  best  of  the 
position  transducers  with  a  failure  rate  of  8  each  10*^  hours  for  this 
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application  according  to  MIL-HDIK-217A.  Figure  35  shows  a  mockup  of  a 
quadruplex  tandem  linear  transformer  using  size  8  devices.  It  weighs 
slightly  over  5  ounces.  The  6-inch  device  could  cause  packaging  problems. 

Use  of  a  pair  of  dual  tandem  devices  in  parallel  would  minimize  this 
problem. 

The  LVDT  is  a  rectilinear  transformer  having  three  windings  vound  on  a 
hollow  core.  One  winding  supplies  the  excitation  flux;  the  other  two  are 
connected  in  series  bucking  to  provide  a  differential  output.  A  movable 
iron  core  varies  the  coupling  between  the  excitation  and  output  windings 
such  that  at  null,  the  voltages  induced  in  the  two  secondaries  cancel. 
Displacement  from  null  causes  a  differential  output  as  the  voltage  in  one 
winding  increases  and  the  other  decreases.  Resolution  is  unlimited.  Exci¬ 
tation  ranges  from  5  to  115  volts  at  400  hertz  depending  the  size  of  the 
LVDT.  Linearity  is  typically  ±0.25  percent  of  full  scale.  Displacement 
ranges  from  ±0.005  to  ±5-0  inches.  Lengths  are  between  0.4  and  5*0  inches; 
diameters  run  between  0.3  and  0.9  inch.  Weight  is  less  than  5  ounces.  Cost 
ranges  from  $25  to  $300.  Tho  failure  rate  of  an  LVDT  is  about  12  each  10° 
hours  according  to  commercial  airline  field  data.  Power  input  (and  output) 
of  a  standard  LVDT  is  less  than  1  watt.  A  special  high  power  LVDT  was 
fabricated  for  Douglas  Aircraft  company  for  their  fly-by-wire  project  (dis¬ 
cussed  in  paragraph  III. 2. a)  which  could  provide  20  watts  of  output  power 
for  each  channel.  The  triple  tandem  LVDT  was  15  inches  long,  3  inches  in 
diameter,  and  weighed  30  pounds.  Total  stroke  was  3  inches. 

Digital  encoders  are  available,  but  they  have  already  been  ruled  out  of 
consideration  due  to  their  incompatibility  with  analog  flight  control  equip¬ 
ment.  They  are  rotary  devices  having  from  100  to  620  counts  for  each  turn 
which  establishes  the  resolution.  A  10  to  200  kilohertz  interrogation  signal 
is  required  plus  the  electronics  for  readout.  Sizes  range  from  a  typical  size 
8  or  11  synchro  case  to  a  2-inch  diameter  and  3-inch  length.  Weight  is  be¬ 
tween  0.25  and  1.0  pound.  Cost  ranges  from  $200  to  $600.  The  reliability  is 
comparable  to  a  potentiometer. 

4.  TRANSMISSION  LINE 

The  prime  considerations  in  selecting  materials  for  the  electrical 
signal  and  power  transmission  lines  are  the  integrity  and  weight.  Weight, 
of  course,  is  to  be  minimized  in  any  flight  control  system.  Integrity  is 
affected  by  damage  caused  during  battle  or  maintenance.  Battle  damage  can 
sever  electrical  cables  (and  hydraulic  lines)  even  if  they  are  protected 
within  a  heavy  conduit.  Maintenance  personnel  can  accidentally  damage  a 
cable  by  drilling  or  cutting  nearby  in  the  airframe  or  by  using  the  cable  as 
a  handhold.  Damage  effects  can  be  minimized  by  separately  routing  redundant 
cables,  one  for  each  channel,  so  that  the  damage  affects  only  one  channel. 

The  physical  separation  of  the  cables  should  be  as  great  as  possible.  The 
connectors  are  also  part  of  the  transmission  line.  Their  integrity  and 
reliability  sure  effected  mostly  by  the  number  of  times  that  they  must  be 
disconnected.  Each  time  a  connector  is  removed  and  replaced,  a  small  chance 
exists  that  pins  will  be  bent  by  forcing  a  misaligned  connector  into  its 
receptacle.  Cable  flexing  also  causes  wear  and  tear  on  the  wiring.  Discon¬ 
nection  is  required  when  a  failure  occurs  in  the  IHU  (line  replaceable  unit) 
or  when  periodic  maintenance  is  needed.  The  mean  time  between  a  required 
disconnect  for  an  electronics  assembly  is  the  inverse  of  the  total  failure 
rate  of  the  IHU.  For  the  fly-by-wire  system,  the  MTHF  (mean  time  between 
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failure)  of  an  electronics  channel  UUJ  is  estimated  to  be  14,000  hours;  for 
a  control  stick  transducer  URU  it  is  25,000  hours,  and  for  an  actuator  lAU 
it  is  1,200  hours.  The  connectors  on  the  first  two  II*U  would  not  likely  be 
exercised  more  them  one  to  four  times  during  the  life  of  the  airplane 
depending  on  the  class  of  aircraft.  (Equipment  in  a  tremsport  operates  for 
6,000  hours  annueilly,  and  the  aircraft  operates  for  at  least  10  years.  The 
meem  lifetime  of  a  fighter  might  be  expected  to  be  5  years.  This  gives  a 
total  equipment  lifetime  operating  time  of  60,000  and  30,000  hours  respec¬ 
tively.)  The  actuator  connector  would  be  used  25  to  50  times  over  the  life 
of  the  aircraft,  assuming  no  regularly  scheduled  maintenance.  Even  this  is 
not  excessive.  Preflight  or  postflight  check  would  detect  any  cable  failure 
before  the  next  flight  to  ensure  transmission  line  integrity. 

Several  choices  of  electrics!,  wire  exist  for  use  in  aircraft: 
standard  stranded  copper,  reinforced  stranded  copper  (mixed  copper  and  stain¬ 
less  steel  stranded  wire),  solid  copper,  and  copper-clad  steel.  Solid  copper 
is  the  least  desirable  because  of  its  relative  inflexibility;  that  is,  it 
tends  to  work  harden  and  become  brittle  more  readily  under  use  and  vibration 
than  stranded  wire.  Copper-clad  steel  has  three  to  five  times  the  tensile 
strength  and  2-1/2  times  the  resistivity  of  an  equal  sized  copper  wire.  A  l6 
gage  wire  is  needed  to  achieve  t he  same  resistivity  as  20  gage  copper.  Its 
relative  stiffness  would  be  a  deterent  for  use  in  connectors  because  it  would 
be  much  harder  to  handle.  The  reinforced  copper  stranded  wire  is  a  good 
compromise.  It  has  16  strands  of  copper  and  3  of  stainless  steel  or  6  of 
copper  and  1  of  stainless.  Its  tensile  strength  and  resistivity  erne  about 
30  and  5  percent  higher  respectively  than  standard  stranded  copper  wire. 

Since  copper  and  steel  have  nearly  the  same  density,  there  is  little  weight 
difference  between  the  various  types.  Also,  in  large  quantities,  little  cost 
difference  exists  between  them.  Therefore,  the  conclusion  is  that  reinforced 
copper  stranded  wire  should  be  used  for  the  fly-by-wire  signal  and  power 
transmission  and  shielding  should  be  used  where  necessary.  Where  additional 
protection  is  desirable,  such  as  in  a  high  maintenance  area,  the  cables  can  be 
run  through  conduit.  Using  conduit  everywhere  1b  not  desirable  because  the 
protection  is  not  needed  and  it  adds  a  weight  penalty. 

5.  SUMMING  JUNCTIONS 

Signal  summing  occurs  at  two  places  in  the  fly-by-wire  systems:  (l) 
where  the  pilot's  command  is  summed  with  C*,  AFCS,  and  possibly  the  trim 
signals;  and  (2)  where  the  servo  command  is  summed  with  servo  feedback.  In 
the  first  case,  all  signals  are  electrical,  and  the  summing  junction  is  an 
electrical  or  electronic  element  such  as  an  amplifier  or  transformer.  A 
transformer  is  unsatisfactory  for  two  reasons.  First,  in  a  redundant  system 
where  all  channels  are  not  excited  by  the  same  power  supply,  signals  to  be 
summed  may  be  out  of  phase  or  even  at  different  frequencies.  This  problem 
of  nonsynchronous  power  supplies  has  been  discussed  previously.  Therefore, 
ac  sunination  is  not  possible.  Even  if  all  channels  are  excited  commonly  to 
eliminate  phasing  problems,  the  transformer  still  has  difficulty  in  summing. 
The  transfer  impedance  is  nonlinear  since  it  depends  on  the  flux  level  in  the 
core.  The  effect  of  a  command  signal  then  depends  on  the  size  of  the  other 
inputs,  such  as  the  AFCS  or  trim,  at  any  particular  instant  and  vice  versa. 

The  shifting  gains  would  be  very  disconcerting  to  the  pilot.  For  example, 
with  no  AFCS  input,  as  when  it  is  not  engaged,  the  pilot  would  get  a  response 
considered  normal.  If  instead  the  AFCS  were  introducing  a  command 
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simultaneously,  the  pilot  would  get  a  lesser  response  because' the  forward 
gain  would  be  reduced.  Therefore,  transformer  summing  junctions  are  un¬ 
desirable.  The  best  summing  Junction  for  use  with  either  synchronous  or 
nonsynchronous  power  is  at  an  amplifier  input  since  summation  can  be  either 
ac  or  dc.  Obviously  for  nonsynchronous  power,  summation  must  be  dc.  The 
amplifier  summing  junction  appears  to  be  an  electrical  ground  to  the  input 
signals  because  it  is  a  current  node.  That  is,  the  sum  of  al  1  currents  at 
the  summing  junction  is  zero.  Hence,  each  input  which  is  summed  through  a 
gain  controlling  resistor  is  electrically  isolated  from  all  others;  the  sum¬ 
mation  is  always  linear  and  independent. 

The  servo  summing  junction  will  be  electrical  where  electrical  feedback 
is  used,  or  it  may  be  a  force  or  position  summing  device  where  mechanical 
feedback  is  employed.  Where  electrical  feedback  is  brought  out  separately 
to  sum  with  the  command  signal  as  is  commonly  done,  the  amplifier  is  ohe 
ideal  device  to  employ.  In  Sperry  Phoenix's  fail-passive  approach  to  be 
described  later  in  Section  VI,  the  feedback  transducer  is  the  summing 
Junction.  The  object  is  to  sum  the  electrical  input  with  the  mechanical 
position  feedback  in  such  a  way  tha*  a  transducer  failure  blocks  trans¬ 
mission  of  the  command  signal.  This  eliminates  the  occurrence  of  an  open 
loop  caused  by  a, loss  of  feedback.  The  transducer  is  a  modified  resolver 
which  is  very  similar  to  the  induction  potent  1  nmeti  r  used  for  the  control 
stick  transducer  except  that  it  has  an  extra  stator  winding.  The  two  stator 
windings  are  wound  at  90  degrees  so  that  their  fluxes  eure  spatially 
orthogonal.  One  winding  supplies  a  constant  excitation  flux  while  the 
other  provides  the  input.  The  vector  sum  of  these  fluxes  induces  a  voltage 
in  the  rotor  winding.  The  rotor  voltage  is  proportional  to  the  sine  of  the 
angle  between  the  flux  vector  and  the  normal  to  the  rotor.  The  output 
voltage  is  the  servo  error  signal.  If  more  then  one  input  comprise  the 
servo  command,  a  summing  simplifier  is  required  for  isolation  as  discussed 
earlier. 

Another  summing  junction  that  has  been  used  with  mechanical  feedback  is 
the  servovalve  torquer.  Current  into  the  torquer  coils  produces  a  torque 
that  operates  the  servovalve.  Mechanical  position  fed  back  through  a  spring 
produces  a  counter  torque  proportional  to  position  which  opposes  the  commend 
torque.  The  torques  just  cancel  at  the  commanded  position  (allowing  for  the 
small  offset  error  required  to  hold  the  load  at  that  position).  This 
technique  is  adequate  in  nonredundant  servos  where  accurate  control  is  not 
required  and  simplicity  is  desired.  The  disadvantages  are  that  changes  in 
temperature  and  the  local  magnetic  field  cause  offset  errors.  Further, 
redundancy  is  extremely  difficult  to  implement  because  of  the  complexity  of 
the  multiple  feedback  links  end  the  almost  impossible  task  of  maintaining 
synchronization  and  alignment  of  the  channels.  The  latter  problem  not  only 
hinders  proper  operation,  but  it  complicates  the  monitoring  task  as  well. 
Therefore,  torque  summation  is  not  desirable  for  fly -by -wire  systems. 

6.  ELECTRONICS 

The  electronics  components,  circuits,  and  packaging  techniques  most 
suitable  for  use  in  fly-by-wire  systems  eure  now  within  the  state  of  the 
eurt  in  automatic  flight  control  system  design.  As  discussed  earlier,  the 


electronics  should  be  primarily  dc  except  for  the  fail-passive  approach  which 
uses  ac  circuitry.  The  difference  between  the  two  as  far  as  components  are 
concerned  is  negligible.  AC  circuitry  requires  a  greater  number  of  demodu¬ 
lators  and  modulators  plus  coupling  capacitors  or  transformers.  Proven 
solid-state  components  and  microcircuits  should  be  used  to  the  greatest 
extent  possible  to  maximize  reliability.  For  example,  transis  or  and 
optoelectronic  switches  have  replaced  signal  relays.  Solid-state  power 
switches  are  available  for  limited  power  switching  only.  A  good  deal  of 
development  is  being  done  in  this  area.  Microcircuits  both  minimize  the 
number  of  components  and  the  number  of  connections  which  Improves  relia¬ 
bility.  Connections  contribute  e.  significant  portion  of  the  total  electro¬ 
nics  failure  rate  primarily  because  of  the  effects  of  the  human  element 
during  manufacture. 

The  use  of  dc  electronics  in  fly-by-wire  control  provides  a  number  of 
advantages  from  the  standpoint  of  simplicity,  accuracy,  and  the  ability  to 
be  microminiaturized.  Such  an  approach  represents  a  significant  departure 
from  the  more  traditional  400-hertz  suppressed-earrier  ac  control  techniques 
which  have  previously  been  used  in  aircraft  flight  control  systems. 

DC  control  systems  have  a  historically  poor  reputation  in  airborne 
applications.  The  severe  problems  associated  with  maintaining  drift  free 
and  balanced  circuit  performance  over  a  wide  temperature  range  plagued  the 
designers  of  dc  control  systems  in  the  vacuum  tube  era.  Chopper-stabilized 
amplifiers  could  cope  with  these  problems  but  only  with  some  undesirable 
penalties  in  circuit  complexity.  The  advent  of  transistors  led  to  even  more 
disastrous  dc  control  system  design  failures,  for  now  the  problem  of  leakage 
and  poorly  controlled  device  parameters  were  added  to  the  vacuum  tule  dc 
amplifier's  more  simple  parameter  tracking  requirements.  It  is  perhaps  a 
knowledge  of  these  early  design  failures  which  has  created  an  attitude  of 
extreme  caution  and  even  reluctance  on  the  part  of  control  system  designers 
and  users  wher  consideration  of  dc  systems  is  suggested.  Yet,  within  the 
past  q  years,  progress  in  semiconductor  device  and  circuit  technology  in 
rela\  on  to  the  dc  operational  amplifier  has  been  so  revolutionary  that  one 
must  reappraise  many  of  the  design  practices,  and  perhaps  even  the  prejudices 
which  often  dictate  the  mechanization  of  control  systems. 

Ironically,  one  of  the  factors  which  has  prevented  a  greater  acceptance 
of  dc  control  systems  is  their  apparent  simplicity.  It  is  easy  to  understand 
the  operation  of  such  systems,  but  a  good  design  involves  many  factors  which 
are  too  easily  overlooked.  Some  system  desig  .ers  have  approached  the  problem 
of  synthesizing  cor.srol  systems  in  the  same  manner  as  they  would  program  a  dc 
analog  computer.  They  have,  therefore,  often  created  modern-day  counterparts 
of  the  early  unsuccessful  dc  systems.  Consequently,  even  the  availability  of 
high  quality  operational  amplifiers  has  not  prevented  their  misapplication  in 
control  system  designs.  Design  factors  too  often  overlooked  involve:  cur¬ 
rent  drift  limitations  which  restrict  resistance  ranges,  impedance  balance 
requirements  which  restrict  flexibility  in  changing  summing  and  feedback 
networks,  and  certain  scaling  and  grounding  restrictions.  These  factors 
will  be  discussed  in  greater  detail  in  succeeding  paragraphs  on  design  con¬ 
siderations.  First,  however,  some  of  the  recent  history  of  Sperry  Phoenix 
dc  flight  control  electronics  designs  is  outlined  in  the  following 
paragraph . 
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In  1964,  Sperry  Phoenix  designed  and  qualified  to  an  extremely  severe 
environment  an  all-dc,  three-axis  aerodynamic  control  autopilot  for  the  USAF 
Maneuvering  Ballistic  Reentry  Vehicle  (MBHV).  The  very  complex,  large 
dynamic  range  and  wide  bandwidth  control  laws,  the  high  precision  require¬ 
ments  for  these  computations,  and  the  stringent  size-weight  requirements 
dictated  the  choice  of  dc  computation  avd  control  techniques.  In  1965, 
production  autopilots  were  delivered  and  as  November  i960,  over  18,000 
operating  hours  have  been  accumulated  on  this  autopilot  design  without  a 
single  electronic  failure  or  performance  degradation.  The  primary  signifi¬ 
cance  of  this  performance  record  is  the  long  term  drift  stability.  This  is 
especially  important  when  it  is  noted  that  not  a  single  trim  potentiometer 
was  required  to  balance  any  control  channel.  A  servo  amplifier  unbalance, 
for  example,  is  less  than  0.05  percent  full  scale.  Figure  36  shows  the 
reentry  vehicle  SAS  to  demonstrate  the  size  of  fly -by -wire  electronics  which 
would  be  comparable. 

The  many  benefits  of  dc  computation,  however,  can  be  obtained  only  by 
careful  observation  of  the  limitations  of  the  dc  operational  amplifier  com¬ 
puting  and  control  techniques.  Some  of  these  limitations  are: 

a.  Signal  limiting  cannot  be  obtained  with  devices  as  simple  as  the  vari¬ 
able  voltage  biased  diodes  commonly  used  in  ac  systems.  It  is  most 
desirable  to  implement  limiting  functions  by  scaling  the  problem  so 
that  the  limit  is  provided  by  the  inherent  saturation  limit  of  the 
amplifier  (about  10  volts  -  zener  diodes  can  be  used  to  adjust  this 
voltage  down  to  about  6  volts ).  This  requirement  imposes  requirements 
on  scaling  and  consequently  limits  the  flexibility  in  changing  limits 
and  control  gain.  Continuously  veuriable  precise  limiters  can  easily 
be  implemented  but  they  are  considerably  more  costly  than  the  variable 
limits  which  are  implemented  with  ac  systems. 

b.  The  ease  of  synthesizing  any  desirable  gain  by  controlling  summing  and 
feedback  resistors  is  deceptive.  Maximum  resistance  values  are  im¬ 
posed  by  current  drift  problems  which  will  be  discussed  subsequently. 
One  cannot,  in  general,  simply  change  the  value  of  the  summing  resis¬ 
tor  to  change  a  gain.  The  amplifier  configuration  allows  summing  at 
either  the  inverting  or  noninverting  inputs  to  maintain  flexibility 
over  signal  polarities.  However,  minimum  drift  operation  of  these 
amplifiers  requires  that  the  impedance  to  ground  from  both  summing 
bases  be  balanced.  Consequently,  changing  or  adding  a  summing  network 
at  one  base  usually  requires  some  adjustment  of  the  impedance  at  the 
other  summing  bases.  This  represents  a  penalty  in  flexibility,  but  a 
good  system  design  can  make  provision  for  changing  and  adding  inputs 
without  causing  any  disruption  of  the  basic  system  building  blocks 
(microelectronic  subassemblies) . 

c.  Isolated,  regulated  internal  power  supplies  are  needed  for  proper  sys¬ 
tem  operation.  The  signed  ground  must  be  isolated  from  power  ground 
of  the  input  power;  thus,  autotransformers  cannot  be  used. 

d.  An  operational  amplifier  having  a  voltage  offset  of  V  millivolts  can¬ 
not  in  general  be  balanced  by  adding  -V  millivolts  at  the  input 
through  a  trim  potentiometer  connected  to  a  dc  voltage  reference. 

This  trimming  operation  may  bring  the  output  to  zero  at  a  given 
temperature  so  that  such  a  procedure  is  allowable  for  operating 
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laboratory  equipment.  In  an  airborne  control  system  design  the 
temperature  drift  effects  are  usually  far  more  significant  than  the 
room  temperature  offset  voltage.  Thus,  achieving  adequate  perfor¬ 
mance  over  the  temperature  environment  involves  design  criteria  other 
than  simple  trim  potentiometer  nulling.  If  these  criteria  are  fol¬ 
lowed,  the  trim  potentiometer  is  usually  unnecessary.  Hie  major  con¬ 
sideration  here  involves  the  allowable  range  of  summing  Impedances  and 
their  relation  to  the  amplifier's  inherent  current  drift. 

While  it  is  well  recognized  that  microelectronic  integrated  circuits 
have  made  a  revolutionary  impact  on  all  aspects  of  avionics  technology,  the 
progress  in  flight  control  has  been  less  rapid  than  in  navigation  and  com¬ 
munication  areas.  This  cautious  approach  to  rcicrocircuitry  springs  from  the 
unique  position  of  the  flight  control  electronics  ar  a  complex  and  often 
unbounded  collector  and  producer  of  signals  and  data  from  and  to  a  multitude 
of  diverse  aircraft  subsystems.  Mocrocircuitry  finds  its  optimum  application 
in  performing  standardized  functions.  This  is  the  very  antithesis  of  the 
autopilot's  traditional  role.  Flight  control  systems  interface  with  ac 
transducers,  dc  transducers,  ac  servos,  dc  servos,  hydraulic  control  valves, 
analog  instrument  displays,  discrete  conmand  switches,  discrete  displays, 
and  any  other  device  that  may  be  created  to  sense,  actuate,  or  display.  The 
electronic  functions  which  a  flight  control  system  must  perform  to  adapt 
the  levels  of  these  various  signals  to  the  low  voltage  operating  levels  of 
microcircuitry  is  often  a  major  part  of  the  signal  processing  functions. 

Hence,  one  can  never  expect  an  all  microelectronic  implementation  of  the 
traditional  flight  control  functions  Until  all  signal  and  logic  interfaces 
are  made  more  compatible  with  microcircuitry  operating  voltage  and  power 
constraints. 

With  the  size  advantage  afforded  by  the  microcircuit  operational 
amplifier,  a  complete,  fairly  sophisticated  computing  function  can  now  be 
packaged  within  a  single  embedded  microelectronic  subassembly  of  a  standard 
0.7  inch  x  0.8  inch  x  1.2  inches  dimensions  (figure  37).  The  computing  and 
control  microelectronic  subassemblies  include  both  microcircuits  and  discrete 
components.  These  highly  efficient  modules  exploit  the  size  and  advantage 
of  microcircuits  to  the  fullest  potential  consistent  with  cost  and  reliabil¬ 
ity  constraints.  A  typical  microcircuit  card  is  shown  in  figure  38. 

Further  systems  will  be  expected  to  employ  the  hybrid  microelectro¬ 
nic  packaging  approach.  ThiB  approach  is  based  on  hybrid  assemblies  of 
microcircuit  chips,  thick  film  resistors,  and  various  forms  of  capacitor 
devices  mounted  on  ceramic  substrates.  When  the  hybrid  technology  is 
sufficiently  developed  where  all  parts  can  be  mounted  to  the  substrate  by 
flip-chipping,  not  only  will  costs  and  weight  be  reduced,  but  the  elimination 
of  wire  interconnects  will  constitute  a  major  reliability  improvement.  Metal 
oxide  semiconductor  (MOS)  techniques  may  reduce  the  size,  cost,  and  weight  of 
hybrid  electronic  assemblies  by  several  orders  of  magnitude,  once  reliability, 
temperature,  and  interface  problems  are  solved. 

7-  ACTUATORS 

Actuators  may  be  required  in  two  places  in  a  fly-by-wire  system:  surface 
actuators  which  are  hydraulic  because  they  provide  higher  power  and  perfor¬ 
mance  in  smaller  packages  than  electrical  actuators,  and  trim  actuators  which 
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Figure  37 

Typical  Microelectronic  Subassembly 
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(a)  COMPONENT  SIDE 


( b )  WIRING  SIDE 

Figure  38 

Typical  Microelectronic  Card  Assemblies 
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are  elect  '•leal  because  they  are  more  reliable  and  smaller  for  the  required 
performance.  The  hydraulic  surface  actuators  are  discussed  in  detail  in 
paragraphs  VI. k  and  VI. 5 •  These  actuators  differ  from  available  actuators 
primarily  jn  the  higher  degree  of  redundancy  employed  and  the  attendant 
design  problems.  They  further  differ  in  that  they  combine  the  functions  of 
the  series  and  boost  actuators  so  that  a  higher-performance  power  actuator 
is  generally  required. 

The  control  stick  actuator  would  be  required  only  if  parallel  stick 
motion  is  deemed  necessary  for  trim  or  AFCS  inputs.  Series  inputs  produce 
no  sti.;k  motion.  Hence,  an  actuator  is  not  necessary  and  the  system  becomes 
simpler  and  more  reliable.  The  power  and  performance  requirements  of  the 
parallel  actuator  are  low  enough  that  small  electromechanical  servos  are 
adequate.  The  trim  actuator  would  position  the  neutral  point  of  the  stick 
centering  spring  in  response  to  commands  from  either  the  pilot's  trim  con¬ 
trols  or  to  rate  commands  proportional  to  the  long  term  average  actuator 
error  signals.  The  unit  would  consist  of  at  least  two  servo  modules,  each 
containing  an  integrating  servo,  and  an  associated  electronics  module.  The 
servo  integrator  Includes  a  tachometer,  gear  train,  and  clutch.  A  typical 
actuator  would  employ  a  standard  size  11  or  15  servo  motor.  Now  a  size  11 
motor  can  provide  30  to  40  pounds  stall  force  and  a  free  speed  of  0.5  inch 
each  second  at  its  output  which  is  clearly  adequate  for  this  application. 

The  weight  of  a  typica^  dual  unit  would  run  about  8  or  9  pounds  and  have  a 
volume  of  250  to  300  cubic  inches. 

8.  AIRCRAFT  MOTION  SEN30RS 

Artificial  feel  can  be  implemented  in  a  number  of  ways  as  discussed  in 
Section  III  including  using  either  C*  feedback  or  dynamic  pressure  q  to 
control  system  gains.  Deriving  C*  requires  attitude  rate  and  normal 
acceleration  sensors;  deriving  q  requires  a  sensor  that  takes  the  ratio  of 
pilot-static  to  total  pressure.  A  summary  of  sensor  requirements  and 
available  types  are  listed  in  tables  I  anu  III. 

The  only  proven  rate  sensor  available  today  is  the  single -degree -of - 
freedom,  spring-restrained  rate  gyro.  Many  types  of  rate  sensing  techniques 
are  being  developed  having  the  primary  purpose  of  eliminating  gyro  spin 
bearings  and  the  wearout  problem  (95  percent  of  all  gyro  failures  are  due  to 
rotor  bearings).  Several  concepts  show  promise,  such  as  the  ring  laser  and 
the  use  of  air  bearings,  but  none  are  expected  to  be  available  and  proven 
within  the  next  2  years.  The  factors  to  consider  in  a  rate  gyro  are  whether 
or  not  it  is  reparable,  the  type  of  pickoff,  the  monitoring  provisions,  and 
expected  life.  A  reparable  gyro  initially  costs  nearly  twice  as  much  as  a 
ncr\reparable  type,  but  its  overall  costs  are  lower  because  it  can  be  over¬ 
hauled.  While  the  nonreparable  types  are  smaller,  this  is  actually  no 
advantage  because  the  smaller  size  reduces  heat  transfer.  Hence,  the  failure 
rate  of  a  nonreparable  is  often  higher  than  a  reparable  one.  A  nonreparable 
gyro  is  typically  1  inch  diameter  x  2-1/2  inches  long  and  weighs  8  ounces;  a 
reparable  type  is  typically  1-1/2  inches  diameter  x  3-1/ 2  inches  long  and 
weighs  14  ounces.  The  reparable  type  is  slightly  larger  to  facilitate 
overhaul,  but  this  allows  incorporation  of  other  features  to  improve  relia¬ 
bility.  In  particular  heat  transfer  is  improved  which  lengthens  bearing 
life.  The  largest  factor  in  bearing  life  is  failure  of  the  lubricant. 
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Larger  bearings  help  maintain  lower  temperatures,  reduce  lubricant  film 
stresses,  and  reduce  shock  susceptibility.  This  problem  is  also  minimized 
by  using  lower  speed  rotors  (12,000  rpo  versus  24,000  rpm  conventional)  and 
by  incorporating  reservoirs  to  ensure  an  adequate  supply  of  lubricant. 
Bearing  life  can  be  increased  by  an  order  of  magnitude  in  this  way.  The 
gyro  should  also  be  helium  filled  to  minimize  lubricant  contamination. 

The  gitnbal  pickoff  should  be  an  inductive  device  to  eliminate  wiper 
contact  as  discussed  in  position  transducers.  A  microsyn  is  very  popular 
because  it  has  no  brushes  or  wipers,  and  it  has  excellent  sensitivity. 
Potentiometers  are  used  in  some  rate  gyros;  these  types  should  be  avoided. 
Self -test  and  monitoring  of  gyros  is  done  in  two  ways  other  than  by  com¬ 
parison  with  another  gyro.  The  simplest  method  is  to  add  a  small  pulse 
generator  to  the  rotor  so  that  it  generates  a  pulse  each  revolution  (or  half 
revolution).  Wheel  speed  can  be  measured  in  this  way.  A  gyro  rotor  has  the 
peculiar  charact eristic  that  it  will  almost  never  quit  running  once  started, 
but  if  it  has  failed  it  will  not  start.  Therefore,  a  wheel  speed  detector 
will  detect  95  percent  of  gyro  failures.  For  a  thorough  gyro  test  such  as 
during  preflight  checks,  an  input  torquer  should  be  available  to  exercise 
the  gyro  much  as  a  rate  input  would  do.  Performance  can  be  Judged  by 
comparing  the  output  for  a  known  input  with  a  predetermined  reference 
response.  This  tests  gimbal  freedom,  damping,  torsion  restraint,  and 
pickoff.  In  most  self -test  schemes,  the  torque  is  applied  to  the  gimbal. 
This  checks  everything  but  the  rotor.  Another  type  of  self -test  device 
applies  a  force  to  one  end  of  the  rotor  to  develop  a  torque  on  the  gimbal. 
Flux  from  a  small  winding  acting  on  the  spinning  rotor  produces  an  eddy 
current  drag  force.  Since  a  test  input  current  produces  a  torque  Just  as 
input  rate  would,  all  functional  elements  of  the  gyro  are  tested  including 
the  rotor  speed.  The  rate  gyro  characteristics  required  in  a  fly-by -wire 
system  are  very  similar  to  stability  augmentation  requirements.  They  are 
listed  in  table  III. 

The  accelerometer  can  be  chosen  from  two  classes:  (l)  spring- 
restrained,  viscous-damped  devices  that  measure  acceleration  directly,  or 
(2)  internally  servoed  devices  in  which  the  acceleration  is  indirectly 
measured  by  the  torquer  signal.  The  latter  type  are  much  more  precise  and 
are  used  extensively  in  inertial  systems.  They  are  more  complex  and 
costly  than  fly-by-wire  applications  can  Justify.  The  former  are  also 
proven  devices  but  are  less  expensive.  Self -test  can  be  supplied  on  either 
type.  As  in  the  gyro  case,  the  torquer  or  output  transducer  should  not 
have  brushes  or  wiper  contacts  for  high  reliability.  Those  types  of 
accelerometers  employing  potentiometer  pickoff s  should  not  be  used. 
Accelerometer  characteristics  required  for  fly-by-wire  applications  are 
listed  in  table  III.  The  lateral  accelerometer  is  included  for  possible 
future  use  in  lateral  C*  command  systems. 

A  simple  q-spring  consists  of  two  chambers  separated  by  a  flexible 
(zero  spring  rate)  diaphragm.  One  chamber  accepts  pilot  pressure  while  the 
other  accepts  static  pressure.  The  flexible  diaphragm  can  function  as  the 
spring  output  or  it  can  serve  as  the  input  to  a  servo  which  provides  the 
actual  restraining  stick  force.  In  the  latter  case,  the  q-spring  becomes  a 
small  air  data  sensor  rather  than  a  large  spring.  This  approach  has  more 
merit  for  use  on  electrical  sticks  because  of  its  smaller  size  even  though 
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it  has  more  parts.  In  an  Installation  that  already  requires  a  parallel 
se/vo,  the  actuator  may  be  able  to  serve  both  purposes.  The  sensor  would  be 
very  similar  to  the  servoed  force-balanced  aneroid  cells  presently  being  used 
In  most  air  data  computers.  Such  coaqputers  are  known  for  their  unreliability. 
Several  companies,  including  Sperry  Phoenix,  sure  developing  solid-state  air 
data  sensors  to  overcome  the  reliability  problem.  Solid-state  sensors  should 
become  available  by  1968. 


SECTION  VI 


SYSTEM  DESIGN 


1.  SYSTEM  DESIGN  CRITERIA 

Thus  far  in  this  report  we  have  described  the  problems  that  exist  in 
modern  mechanical  flight  control  systems  that  prevent  achieving  their  per¬ 
formance  objectives.  We  have  described  the  fly-by-wire  approach  to  its 
solution.  We  have  also  discussed  the  component  selection  available  for  its 
construction.  Before  proceeding  further,  we  must  establish  the  flight  control 
system  constraints  and  design  criteria  around  which  we  must  work.  The  design 
criteria  may  be  broadly  categorized  as  to  performance,  reliability,  cost,  and 
maintainability.  The  performance  criteria  includes  not  only  handling  quali¬ 
ties  and  path  control  but  weight  and  volume  ae  well.  The  design  requirement 
is  generally  speaking  to  be  able  to  meet  the  same  handling  qualities  and  path 
control  as  the  mechanical  systems  according  to  military  specifications.  The 
system  must  also  match  or  exceed  the  weight,  volume,  reliability,  cost  and 
maintainability  of  present-day  mechanical  designs.  We  have  demonstrated  by 
example  and  comparison  that  the  performance,  cost,  and  maintainability  crite¬ 
ria  can  be  satisfied. 

The  reliability  criterion  employed  is  the  accident  rate  for  commercial 
airliners  attributed  to  the  flight  control  system  as  established  by  Kaman  in 
their  study.  Hie  data  were  derived  from  the  maintenance  records  of  the  Civil 
Aeronautics  Board  and  the  Federal  Aviation  Agency  for  the  period  of  1952  to 
1959-  The  probability  of  a  flight  control  system  failure  for  a  1-hour  flight 
is  2.3  x  10”7.  This  value  establishes  our  reliability  criterion.  It  is  more 
stringent  than  many  military  aircraft  can  meet  as  evidenced  by  data  from 
older  aircraft.  For  example,  the  failure  rate  employed  by  Douglas  Aircraft  in 
their  study  was  based  on  the  AD  Skyraider  pitch  axis  failure  rate  of  6.l4  x 
10-*  for  a  1-1/2  hour  flight. 

2.  SYSTEM  CONSTRAINTS 

The  system  constraints  which  establish  the  outer  boundaries  of  the 
design  problem  result  from  the  flight  control  system's  environment  (available 
space  and  power,  temperature,  vibration,  shock,  humidity,  and  so  on)  and  the 
state  of  the  art  not  only  in  components  and  materials  but  knowledge  as  well. 
Environmental  constraints  relate  to  the  aircraft  while  state-of-the-art 
constraints  relate  to  the  control  By stem. 

Space  constraints  are  most  important  to  the  actuator  configuration.  The 
higher  degrees  of  redundancy  called  for  in  fly -by-wire  systems  generally 
produce  larger  packages;  hence  Bpace  limitations  will  be  important .  Available 
power  is  no  more  a  constraint  for  fly-by-wire  than  mechanical  since  the 
actuution  requirements  are  essentially  the  same,  and  the  solid-state  control 
electronics  cause  relatively  small  power  drain.  However,  the  number  of 
supplies  Is  something  of  a  constraint  because  the  implementation  of  an  odd 
degree  of  redundancy  (e.g.,  triplex)  with  an  even  number  of  power  supplies 
(e.g.,  dual)  and  vice  versa  is  inefficient  particularly  at  the  actuator. 
Operating  triplex  actuators  from  dual  supplies  requires  special  switching. 
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Temperature  constraints  limit  the  selection  of  materials  or  equipment 
location.  This  constraint  normally  affects  only  supersonic  aircraft  traveling 
over  Mach  2  where  aerodynamic  heating  begins  to  cause  problems.  For  example, 
at  Mach  3  the  aircraft  skin  temperature  is  around  450®  to  500*F  (232®  to 
26o®C)  which  is  well  above  the  tolerable  environment  for  electronics  as  well 
as  some  hydraulic  fluids  and  plastics.  Temperatures  above  l6o*F  (71.1®c)  are 
detrimental  to  rate  gyro  life. 

Vibration  and  shock  are  detrimental  to  everything.  Location,  orienta¬ 
tion,  and  packaging  are  constrained  by  these  parameters.  Long  tandem  actu¬ 
ators,  for  example,  are  greatly  affected  by  vibration.  Vibration  can  shorten 
gyro  bearing  life  substantially. 

An  additional  constraint  appears  primarily  in  high  performance  aircraft 
where  control  surfaces  are  very  effective  and  aircraft  response  Is  fast. 

The  constraint  is  the  maximum  allowable  aerodynamic  load  imposed  on  airframe 
by  failure-induced  transients  or  excessive  commands.  The  UBe  of  C*  coranands 
eliminates  the  latter.  Failure  transients  result  from  relatively  slow 
detection  and  channel  switchover  times  during  hardover  failures.  Estimates 
of  the  least  upper  bound  on  detection  plus  switching  time  range  from  30  to  50 
milliseconds.  For  very  large  aircraft  such  as  the  C-5A,  this  value  may  be  as 
high  as  0.5  second. 

The  control  system  constraints  due  to  limitations  in  the  state  of  the 
art  of  knowledge  and  components  and  materials  are  slowly  receding.  Knowledge 
lacks  in  the  areas  of  handling  qualities,  efficient  redundancy  implementation, 
and  the  ability  of  engineers  to  work  in  multiple  disciplines.  High  relia¬ 
bility  components  are  needed  particularly  in  the  apparently  neglected  areas  of 
electrical  and  hydraulic  power  generation  and  in  electrohydraulic  servovalve 
and  engage  solenoid  design.  Compatibility  of  components  has  already  been 
discussed. 

3.  ADDITIONAL  CONSIDERATIONS 

Aside  from  the  system  requirements,  criteria,  and  constraints  just  dis¬ 
cussed,  some  additional  considerations  must  be  kept  in  mind  during  the  design 
process.  One  is  the  desirable  interchangeability  of  components  between  air¬ 
craft  which  is  a  fringe  benefit  of  the  fly -by-wire  approach.  This  greatly 
improves  maintenance  and  logistics.  However,  VTQL  aircraft  will  very -likely 
require  a  different  controller  than  a  conventional  aircraft  because  VTOL 
aircraft  have  different  requirements  at  hover,  arid  the  blending  from  hover  to 
cruise  complicates  the  design.  While  interchangeability  amongst  conventional 
aircraft  will  be  high  and  likewise  for  VTOL  aircraft,  interchangeability 
between  conventional  and  VTOL  aircraft  will  likely  be  low. 

Fast  maintenance  requires  failure  reporting  and  BITE  as  well  as  good 
access  and  simple  replacement.  This  also  enhances  short  preflight  checkout 
time  which  is  becoming  a  must  for  combat  crews.  A  10-seccnd  checkout  time 
should  be  a  practical  goal.  Control  system  maintenance  will  probably  occur 
more  often  in  a  fly-by-wire  system  because  of  the  high  degree  of  redundancy 
necessary  to  achieve  the  desired  system  reliability.  Good  accessibility, 
maintainability,  and  failure  reporting,  however,  will  produce  aircraft  down 
time  equivalent  to  or  better  than  those  obtained  with  a  mechanical  control 
system . 
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To  minimize  battle  or  maintenance  damage,  the  electronics  should  be 
packaged  by  channel  (i.e.,  all  channel  A's  packaged  together,  ail  channel  B*s 
together,  etc)  and  located  separately.  The  redundant  cables  should  also  be 
routed  separately.  To  provide  the  desired  system  reliability,  the  fly-by- 
wire  control  system  must  be  capable  of  continued  operation  after  the  occur¬ 
rence  of  two  failures.  This  will  be  discussed  in  the  next  subsection.  When 
a  third  failure  is  indicated,  the  system  shc^d  fail  to  a  center  position  or 
locked  to  a  predetermined  trim  position.  Th 'Si  statements  cannot  apply 
to  an  aircraft  having  only  two  electrical  or  two  hydraulic  power  sources 
since  failure  of  both  hydraulic  or  both  electrical  supplies  would  produce 
control  system  failure.  The  fly -by-wire  control  system  must  operate  with 
undegraded  performance  after  a  single  failure.  A  second  failure  may  produce 
limited  degradation  in  performance,  but  it  should  be  6uch  that  safe  flight  of 
the  aircraft  is  not  impaired. 

The  monitoring  circuits  should  be  capable  of  reporting  failures  to  the 
pilot's  station  not  only  to  provide  maintenance  information  but  also  to  inform 
the  pilot  of  control  system  status.  Hie  monitors  must  be  either  fail-safe, 
that  is,  report  their  own  failures,  or  demonstrate  reliability  of  such  a 
degree  as  to  not  degrade  system  reliability  when  placed  in  series  with  the 
system.  These  monitors  and  switching  circuits  provide  automatic  selection  of 
operational  control  channels  for  the  first  two  failures. 

A  fly-by-wire  control  system  should  have  in-flight  reset  capability 
from  the  pilot's  station  to  be  able  to  clear  false  alarms.  In  addition,  the 
monitoring  and  switching  logic  should  be  designed  to  allow  the  pilot  to  select 
any  control  channel  after  a  third  failure  has  occurred.  This  additional  logic 
could  result  in  a  three-fail-operate  system  with  pilot  select  upon  the  third 
failure  if  the  system  is  quadruplex  or  if  the  remaining  channel  is  not  the 
model  in  the  triplex  system. 

4.  TRADEOFFS 

a.  System  Tradeoffs 

Many  of  the  tradeoffs  to  be  considered  in  a  fly-by-wire  design  have 
already  been  discussed.  Artificial  feel  techniques  were  described  in 
Sections  III  and  IV  from  which  the  C*  command  approach  was  chosen.  The 
tradeoff  between  parallel  and  series  trim  cannot  be  made  because  it  depends 
primarily  on  the  human  factors  problem  of  whether  or  not  parallel  stick 
motion  is  required.  On  the  basis  of  reliability  and  simplicity,  series  trim 
is  preferred  because  it  eliminates  an  actuator.  Section  V  contains  the 
tradeoff  discussions  concerning  the  control  stick,  transducers,  signal  types, 
transmission  line,  surmning  Junctions,  aircraft  motion  sensors,  and  the 
electronics.  The  remaining  tradeoffs  to  be  made  concern  the  degree  of  system 
redundancy  to  employ  and  the  actuator  configuration  tradeoffs. 

b.  Degree  of  Redundancy 

Without  doubt,  unless  the  fly-by-wire  system  design  employs  redun¬ 
dancy,  its  reliability  will  never  meet  or  exceed  that  of  current  mechanical 
systems.  The  reliability  criterion,  or  rather  the  probability  of  failure 
criterion,  has  been  established  as  2.3  x  10“  7  each  hour.  We  can  relate  this 
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value  to  the  degree  of  redundancy  required  by  considering  the  reliability 
equations  for  an  example  control  axis  having  different  redundancy  imple¬ 
mentations.  This  is  best  done  by  considering  the  unreliability  or  the 
probability  of  failure  Q(t)  rather  than  the  reliability  R(t)  because  the 
calculations  are  simpler  and  more  meaningful.  These  parameters  are  related 
by 


R(t)  +  Q(t)  -  1 

The  parameters  are  a  function  of  time  because  the  equations  are  nonlinear  for 
redundant  systems.  The  following  table  lists  the  various  redundancy  imple¬ 
mentations  and  their  probabilities  of  failure  assuming  random  failures  and 
perfect  monitors.  The  assumed  failure  rate  for  each  hour  X  for  our  example 
channel,  is  10"3.  (The  actual  failure  rate  might  range  between  0.4  x  10“3  and 
10"3 . ) 

Number  of  Channels 


That  Must  Operate 
For  System  Success 

q(t) 

Q(l  hour) 

Channel  X  to 

MTBF  Just  Meet  Criterion 

Single  Channel 

At 

10"3 

1000 

7.7  x  10"8 

One  of  Two 

(xt )® 

10"6 

500 

2.8  x  10"4 

One  of  Three 

(»t)3 

10-9 

333 

4.3  x  10“3 

Two  of  Three 

3 (At)2 

3  x  10-6 

333 

1.6  x  10"4 

Two  of  Four 

4(xt)3 

4  x  10"9 

250 

2.7  x  10 '3 

The  value  for  Q(l  hour)  must  be  compared  with  a  third 
7.7  x  10"°  since  we  are  talking  about  a  Bingle  axis, 
immediately  apparent  Js  that  the  systems  meeting  the 

of  2.3  x  10"T  or 

The  fact  that  becomes 
criterion  must  be 

capable  of  tolerating  double  failures;  that  is,  the  system  must  be  able  to 
operate  on  one  of  th"ee  channels  or  two  of  four  channels.  The  MTBF  is  the 
inverse  of  the  total  failure  rate.  It  provides  a  measure  of  the  mean  time 
to  the  first  failure  when  starting  with  a  completely  healthy  system.  Tt  is 
therefore  a  measure  of  the  relative  complexity  arid  of  how  often  maintenance 
actions  are  required.  Ideally,  the  triplex  system  would  be  the  choice  be¬ 
cause  of  its  lower  complexity.  However,  our  simplified  example  does  not  take 
into  account  the  added  monitoring  equipment  needed  to  be  able  to  correctly 
identify  and  switch  out  the  channels.  Depending  on  the  particular  system, 
the  extra  equipment  more  often  than  not  amounts  to  a  fourth  channel.  Other 
factors  not  considered  are  the  degree  to  which  the  monitors  are  Imperfect 
(i.e.,  cannot  detect  all  failures  or  fails  without  indication  so  that  a 
subsequent  channel  failure  goes  undetected)  and  the  presence  of  common 
elements  (such  as  an  output  member)  with  small  but  finite  failure  rates 
which  can  cause  system  failure.  The  last  column  in  the  table  represents  that 
failure  rate  which  an  Ideal  channel  must  have  such  that  the  system  will  just 
meet  the  reliability  criterion.  Again,  the  Bystem  that  can  tolerate  double 
failures  can  easily  meet  this  requirement  since  a  practical  channel  including 
the  C*  sensors  would  have  b  X  ranging  from  4  x  10"4  to  10"3  depending  on  the 
type  of  components  used.  Note  that  with  a  factor  of  four  reliability  improve¬ 
ment,  the  dual  system  would  also  meet  the  criterion.  A  factor  of  six 
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improvement  would  be  necessary  for  the  two  of  three  system.  Therefore, 
assuming  that  the  reliability  criterion  did  not  change  and  channel  reliability 
were  to  improve  by  four  to  six  times  in  the  near  future,  then  a  fail- 
operational  system  would  provide  adequate  reliability.  It  would  also  be 
less  complex,  smaller,  lighter,  and  require  less  maintenance. 

Another  approach  to  redundancy  is  the  optimizing  technique  called  fail- 
passive  design  which  was  described  in  Section  III  under  Related  Work.  With 
this  technique  the  triplex  system  is  optimum  because  little  or  no  added 
monitoring  equipment  is  necessary.  In  fact,  a  dual  fail  'passive  Bystem  will 
come  very  close  to  meeting  the  reliability  criterion  today. 

c .  Actuator  Tradeoffs 

The  design  of  actuators  which  will  operate  after  double  failures 
involves  a  large  number  of  parameters  and  tradeoff  factors.  The  development 
of  such  actuators  is  important  to  the  practical  application  of  fly-by-wire 
control.  The  important  design  parameters  and  factors  (all  of  which  are  to 
be  minimized)  are  as  follows: 

(1)  failure  rate  (including  false  alarm  rate) 

(2)  Switching  time  and  transient  caused  by  a  failure 

(3)  Cost  (including  initial  and  maintenance) 

(U)  Size  (volume) 

(5)  Weight 

These  parameters  are  all  relative  except  the  second  for  which  an 
absolute  (even  though  somewhat  subjective)  standard  is  defined.  The  standard 
system  for  comparison  is  a  conventional  nonredundant  actuator.  The  maximum 
switching  time  criterion  is  based  on  a  maximum  allowed  normal  acceleration 
or  displacement,  which  is  regarded  as  unsafe,  at  the  flight  condition  for 
maxin  n  control  effectiveness  (e.g.,  Mach  0.9  at  sea  level)  for  the  aircraft 
in  question.  The  time  is  measured  from  the  onset  of  a  hardover  failure  to 
the  time  when  normal  operation  (i.e.,  proper  actuator  output)  is  restored. 

This  includes  the  time  to  detect  the  failure  and  the  time  to  switch  out  the 
failed  channel.  Switching  in  a  new  channel,  if  required,  Is  assumed  to 
occur  simultaneously  with  switching  out  the  failed  channel.  The  selection  time 
may  range  up  to  300  milliseconds  depending  on  the  class  of  aircraft.  A  time 
of  50  milliseconds  is  assumed  for  this  study. 

The  search  for  suitable  actuator  designs  is  hampered  by  the  great 
number  of  tradeoff  factors  involved  which  Include  the  following: 

(1)  Degree  of  redundancy  (dual,  triple,  quadruple,  etc) 

(2)  Type  of  redundancy  (active  or  standby) 

(3)  Position  or  force  summation 

(k)  Type  of  servovalve  (flow  or  pressure  control) 

(5)  Hydraulic  or  electronic  monitoring 

(6)  Secondary  actuator  (yes  or  no) 

(7)  Mechanical  or  electrical  feedback 


Additional  factors  complicating  the  design  are  the: 

(1)  Number  of  power  supplies  (two,  three,  four,  ...) 

(2)  Available  space  for  the  actuator 

The  number  of  possible  combinations  is  in  the  thousands.  However,  by  in¬ 
vestigating  these  factors  more  closely,  we  can  eliminate  some  of  them  or  at 
least  minimize  their  influence  on  the  design  thereby  reducing  the  number  of 
combinations  to  a  tractable  level. 

First  of  all,  the  degree  of  redundancy  employed  is  related  to  the 
double  fail-operational  requirement .  Triplex  actuators  are  awkward  to  design 
for  two  or  four  hydraulic  supplies,  and  duplex  or  quadruplex  actuators  are 
awkward  to  design  for  three  supplies.  To  meet  the  reliability  requirement,  at 
least  three  channels  are  required  to  ensure  that  at  least  one  channel  remains 
operational  after  two  failures.  Further,  to  ensure  that  the  actuator  fails  to 
neutral  (or  trim),  a  fourth  channel  is  needed  for  comparison  with  the  third. 

The  fourth  channel  may  £••»  real  or  simulrted  (this  is  a  minor  tradeoff  factor 
not  listed  above).  This  means  that  in  one  form  or  another,  a  minimum  of 
quadruplex  redundancy  is  required  in  the  actuators.  Note  that  since  the 
electrical  and  hydraulic  power  supplies  are  independently  monitored,  three 
supplies  cure  needed;  systems  with  dual  supplies  will  compromise  the  flight 
control  system  reliability  unless  the  supply  reliability  is  improved  signifi¬ 
cantly.  The  failure  rate  of  a  hydraulic  power  supply  is  typically  one  each 
thousand  hours.  Therefore,  the  probability  of  two  hydraulic  supplies  failing 
within  a  1-hour  flight  is  10"°.  This  failure  rate  is  higher  than  the  control 
system  itself. 

In  active  redundancy,  all  channels  are  in  the  control  path;  in  standby 
redundancy,  one  channel  is  active  while  all  other  channels  are  operating  but 
not  in  the  control  path.  Active  redundancy  is  preferred  over  standby,  particu¬ 
larly  in  the  actuator,  for  two  major  reasons.  First,  a  transient  caused  by  a 
failure  or  in  switching  out  a  failed  channel  is  minimized  by  the  opposing 
actions  of  the  other  channels.  Second,  the  packaging  efficiency  is  better  in 
an  active  system  because  the  actuators  are  sized  such  that  at  least  two  cam 
carry  the  load.  In  standby  redundancy,  however,  each  actuator  must  be  sized  to 
carry  the  load  thereby  requiring  actuators  with  at  least  twice  the  capability 
as  before.  The  standby  redundant  actuator  will  then  be  larger  and  heavier  by 
approximately  30  percent.  The  primary  reason  for  using  standby  redundancy  is 
to  maintain  constant  performance  after  one  or  more  failures.  This  is  another 
important  consideration  where  a  surface  position  is  comnanded  as  in  most  con¬ 
trol  systems.  If  in  a  high-Q  condition  an  excessively  large  position  is  com¬ 
manded,  stresses  on  the  airframe  or  the  surface  may  be  excessively  large. 
Therefore,  the  actuates  is  designed  with  a  force  limit  so  that  the  large 
position  cannot  be  comnanded.  Now  in  a  C*  comnand  system,  the  pilot  comnands 
an  aircraft  acceleration  or  rate  rather  than  surface  position.  The  surface 
goes  to  whatever  position  is  required  for  the  maneuver.  The  C*  comnand  system 
protects  the  airframe  by  limiting  the  maximum  cotnmandable  acceleration.  Since 
the  surface  actuator  is  now  merely  one  component  in  the  forward  path  of  a  high 
gain  control  system,  its  performance  need  not  be  held  constant.  Degradation  or 
variation  of  performance  due  to  failures  has  relatively  little  effect  on  the 
performance  of  the  overall  system  (in  the  linear  range).  Because  of  the  high 
forward  gain  and  control  effectiveness  at  high-Q  flights,  large  surface  dis¬ 
placements  do  not  occur  even  for  abrupt  maneuvers.  Therefore,  aircraft  loads 
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will  not  be  excessive.  It  should  be  pointed  out  that  local  stress  levels  are 
not  cortrolled  directly  by  C*.  In  a  triplex  active  system,  the  actuator  is 
sized  so  that  any  two  channels  can  satisfy  the  force  requirements.  Then,  under 
normel  conditions,  a  50  percent  excess  will  be  available.  This  level  should 
not  overstress  a  control  surface.  However,  if  the  maximum  force  output  of  any 
active  redundancy  actuator  exceeds  the  designed  safe  level  for  a  surface, 
then  the  safe  level  will  establish  the  maximum  allowed  output.  The  resulting 
actuator  can  still  provide  the  required  performance  with  one  failure  in  a  C* 
command  system  and  satisfactory  performance  untir  double  failure  conditions. 

Two  methods  of  sunning  the  outputs  of  redundant  actuators  are  by 
force  and  by  position.  Force  sunmation  combines  actuator  outputs  through  a 
rigid  link  so  that  relative  motion  between  the  channels  does  not  occur. 

Examples  would  be  connecting  actuator  pistons  in  tandem  on  a  common  shaft 
or  in  parallel  into  a  torque  tube.  The  actuators  then  are  add  forced  to  have 
the  same  position  and  velocity,  and  the  load  force  is  shared.  Position  sum¬ 
mation  allows  relative  motion  between  channels  through  a  "walking  beam"  link. 
Under  normal  conditions  both  techniques  operate  identically,  but  under 
various  failure  conditions,  the  differences  become  apparent.  The  four  types 
of  failure  conditions  are  hardover  output,  free  or  passive,  hydraulic  lock, 
and  seizure  or  Jam. 

In  force  summation,  a  failure  reduces  the  maximum  force  available, 
but  the  position  and  velocity  remain  unchanged.  This  assumes  that  a  hardover 
failure  or  hydraulic  lock  is  bypassed  and  eliminated.  A  seizure  or  Jam  fails 
the  entire  system  since  all  outputs  are  locked.  Fortunately,  actuators  can  be 
designed  with  no  meted-to-raetal  contact  so  that  the  probability  of  seizure  is 
essentially  zero.  A  hardover  force  in  one  channel  is  opposed  by  the  other 
channels  as  soon  as  sufficient  output  motion  occurs  to  generate  opposing  error 
signals.  Because  of  the  high  servo  gains  normally  used,  the  output  error  is 
very  small  (e.g.,  0.1  percent  of  full  stroke).  This  action  also  naturally 
minimizes  transients. 

In  position  summation,  a  failure  generally  reduces  the  output  stroke 
and  velocity  (e.g.,  in  half  for  a  dual  system),  but  the  force  output  remains 
unchanged  because  the  output  moment  arm  is  half  the  actuator  moment  arm. 

The  position  gain  must  be  increased  to  regain  the  proper  output.  This 
leaves  a  system  with  normal  position  gradient  and  force  but  with  half  its 
former  rate  or  frequency  response.  A  seizure  or  hydraulic  lock  does  not 
affect  performance  (unless  it  occurs  off  center  position)  since  the  failed 
channel  must  be  locked  in  any  case.  A  free  failure  fails  the  system  unless 
the  failed  channel  Is  centered  and  locked  because  no  output  motion  cm 
occur.  The  good  channels  oppose  a  hardover  position  failure  in  one  channel 
by  going  hardover  in  the  opposite  directi'  n.  The  net  result  is  a  small 
position  offset  from  the  neutral  position.  However,  the  size  of  the  transient 
depends  on  where  the  position  transducers  are  located.  If  they  are  located 
after  the  summing  linkage,  the  opposing  effect  is  immediate  since  the  system 
automatically  trie3  to  maintain  the  commanded  position.  If  they  are  located 
before  the  summing  linkage,  the  correcting  or  offsetting  error  signal  does 
not  develop  until  after  the  aircraft  responds  to  the  failure  and  a  C*  signal 
develops.  Therefore,  in  tne  latter  case,  a  significant  transient  could 
develop.  Failure  detection  depends  on  information  from  individual  channel 
positions  and  velocities  (servo  error  signsds).  Position  summing  has  been 
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popular  because  the  availability  of  both  servo  positions  simplifies  monitoring. 
However,  for  higher  degrees  of  redundancy,  all  positions  may  not  be  separately 
available  without  using  an  extremely  complex  summing  mechanism.  For  example, 
a  practical  quadruplex  system  could  likely  sum  two  dual  tandem  actuators. 
Monitoring  actually  becomes  more  complex  them  in  force  summing  because  position 
data  alone  do  not  allow  unambiguous  detection  of  the  failed  channel  unless  each 
channel  in  independently  monitored.  Position  summation  has  also  been  used  in 
the  past  in  dual  systems  for  packaging  considerations  because  the  actuators  are 
side  by  side  wheras  force  sunned  actuators  were  comnonly  end  to  end.  However, 
higher  degrees  of  redundancy  make  position  summing  mechanization  very  complex, 
and  force  summing  into  a  torque  tube  now  provides  a  simple  side  by  side 
arrangement .  The  conclusion  drawn  from  this  discussion  is  that  the  fly-by-wire 
active  redundant  actuators  should  be  force  summed. 

No  clear-cut  choice  exists  between  the  use  of  pressure  control 
(single-stage)  and  flow  control  (two-stage)  servovalves.  A  pressure  control 
valve  generally  serves  as  the  first  stage  of  a  flow  control  valve.  The 
second-stage  spool  valve  (sometimes  two  spool  valves  operate  in  cascade)  is 
a  power  amplifier  to  provide  high  performance  output.  The  power  stage  can 
be  operated  separately  from  the  valve  as  a  secondary  actuator  which  is 
discussed  later. 

The  servo  monitor  consists  of  comparators  and  logic  circuits  which 
detect  failures  and  determine  which  channel  haB  failed  so  that  it  can  be 
disconnected.  The  function  can  be  mechanized  with  either  electronic  or 
hydraulic  techniques.  Electronic  monitoring  is  the  more  proven  technique. 

It  utilizes  signals  from  electrical  position  transducers  on  the  actuator 
output  and/or  valve  spools,  differential  pressure  transducers  across 
the  actuator  piston,  or  the  servo  amplifier  error  signals.  Electronically 
simulated  channels  are  also  employed.  Signals  within  a  channel  can  be 
correlated,  and  signals  between  channels  compared  by  electronic  circuitry. 

The  electronic  logic  disengages  a  channel  through  electrohydraulic  solenoidB 
which  operate  hydraulic  engage  valves  and  lockB.  Hydraulic  monitoring  is 
relatively  recent  (being  presently  used  in  the  F-lll  series  actuators). 
Hydraulic  valve  spool  and  actuator  position  transducers  are  now  being  used 
with  8 pool  valves  acting  as  comparators  and  logic.  Conceivably,  future 
techniques  would  include  using  differential  pressure  sensors  and  fluidic 
comparators  and  logic;  this  would  eliminate  the  use  of  moving  parts  and 
improve  reliability.  A  mouel  channel,  when  used,  may  consist  of  a  real  channel 
that  never  drives  the  load.  It  supplies  a  voting  reference  for  the  working 
channels.  The  logic  drives  the  engage  valves  directly. 

A  relative  comparison  of  the  two  techniques  shows  the  following. 
Electronic  monitoring  has  advantages  of  flexibility,  having  fail-safe 
comparators  and  logic,  being  easily  made  redundant,  and  smaller  size  and 
weight.  It 8  primary  disadvantage  is  that  the  components  in  the  electro- 
hydraulic  interface  cure  relatively  unreliable  compared  to  the  electronic  or 
hydraulic  components,  and  they  add  undesirable  time  lags  to  channel  switching. 
For  instance,  the  switching  time  of  presently  available  solenoids  is  at  least 
2 5  milliseconds. 
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The  primary  advantage  of  hydraulic  monitoring  is  its  fast  channel 
switching  time,  which  can  be  less  than  10  milliseconds,  because  the  electro- 
hydraulic  interface  does  not  exist.  This  also  eliminates  the  need  for 
electrical  power  for  switching.  On  the  other  hand,  the  fast  dynamic  response 
of  the  comparators  plus  the  relatively  small  thresholds  used  force  a  require¬ 
ment  for  tight  electronic  tolerance  controls  to  ensure  that  the  channels  track 
thereby  minimizing  the  false  alarm  (nuisance  trip)  rate.  Channel  matching 
could  ease  the  problem  but  this  approach  is  not  desirable  because  of  the 
difficulty  in  maintaining  a  dynamic  match.  The  use  of  higher  degrees  of 
redundancy  further  magnifies  the  problem.  The  result  of  the  tight  tolerance 
requirements  is  to  increase  costs,  both  initial  and  maintenance. 

The  use  of  a  secondary  actuator  to  drive  the  boost  or  power  actuator 
is  a  tradeoff  against  driving  the  actuator  directly  with  a  two-stage  (or 
three-stage)  servovalve.  The  secondary  actuator  evolved  from  the  familiar 
series  servo  and  boost  servo  combinati <">n.  The  Btall  force  of  the  secondary 
actuator  will  range  between  200  and  600  pounds  in  most  applications.  This 
force  is  equal  to  or  greater  than  the  pilot  input  force  on  present  boost 
actuators  in  mechanical  control  systems.  The  mechanical  feedback  linkage  is 
redundant,  and  it  can  be  contained  internally  and  sealed  in  hydraulic  fluid. 
This  technique  is  currently  being  used  on  some  nonredundant  actuators.  One 
prime  reason  for  using  the  secondary  actuator  is  to  move  the  monitor  point 
away  from  the  servovalve  spool.  Attaching  a  position  transducer  to  the  spool 
reduces  the  frequency  response  of  the  valve  and  complicates  the  design.  For 
example,  to  attach  an  LVDT  onto  a  spool  either  requires  a  cavity  at  one  end 
of  the  spool  to  house  the  armature,  or  it  requires  a  Beal  to  acconmodate  an 
external  mounting.  The  seal  adds  an  undesirable  friction  force.  The  cavity 
causes  an  unbalanced  flow  gradient;  adding  a  cavity  on  the  other  end  of  spool 
balances  the  gradient.  However,  the  presence  of  the  two  cavities  pluB  the 
LVDT  slug  inertia  reduces  the  high  frequency  response  of  the  valve. 

Adding  a  secondary  actuator  eliminates  these  problems  while  providing 
a  mode  for  monitoring  actuator  rate.  Several  additional  advantages  accrue 
from  employing  a  secondary  actuator.  First,  the  channels  of  the  tandem 
spool  valve  driven  by  the  secondary  actuator  can  be  readily  synchronized  to 
eliminate  fighting  between  the  redundant  actuators.  ThiB  allows  use  of  active 
redundancy.  Second,  a  center  end  lock  mechanism  acting  on  the  relatively  low 
power  secondary  actuator  rather  than  the  power  actuator  can  be  very  small  and 
light  yet  remain  effective.  Third,  while  a  two-stage  valve  could  very  well 
drive  the  secondary  actuator,  a  simple  single  stage  will  be  adequate  for  most 
applications.  In  this  case,  the  secondary  actuator  and  tandem  control  valve 
combination  can  be  thought  of  as  being  a  variety  of  a  second-stage  spool 
valve.  This  allows  simplification  of  the  servovalve  design.  While  it  is  true 
that  driving  the  actuator  directly  by  the  valve  eliminates  the  mechanical 
linkage  and  secondary  actuator,  synchronizing  the  channels  is  not  an  easy  task. 
The  synchronization  mechanism  adds  undue  complexity  and  reduces  the  indepen¬ 
dence  of  channel  failures  because  the  channels  must  be  interconnected.  There¬ 
fore,  the  actuator  must  employ  standby  redundancy  to  eliminate  fighting.  This 
means  that  each  actuator  must  be  6ized  to  carry  the  load,  as  discussed  earlier. 
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The  tradeoff  between  electrical  and  mechanical  feedback  is  real  when 
nonredundant  or  even  duplex  actuators  are  considered.  However,  when  triplex 
or  quadruplex  (or  greater)  actuators  are  considered,  the  complexity  of 
mechanical  feedback  and  its  synchronization  problems  when  compared  to  the 
relatively  simple  and  flexible  electrical  feedback  virtually  eliminate 
mechanical  feedback  from  further  consideration. 

Before  summarizing  the  tradeoff  factors,  several  additional  consider¬ 
ations  primarily  concerning  monitors  must  be  weighed.  Several  monitorless 
control  system  schemes  have  developed  in  which  the  system  tolerates  one  or 
more  failures  without  the  benefit  of  monitors  thus  simplifying  the  design. 
Notable  amcngst  these  are  the  NAA  Autonetics  "Tri-Safe"  and  the  Sperry 
Phoenix  "fail-passive"  design.  Although  these  designs  can  operate  without 
monitors,  the  failure  reporting  requirements  demands  that  monitoring  be 
employed . 

Two  general  classes  of  monitoring  are  available:  in-line  and 
comparison.  In-line  monitoring  employs  a  test  signal,  usually  continuous,  to 
which  the  control  system  will  not  respond  yet  which  can  be  traced  through  the 
system  or  group  of  components  to  test  signal  path  continuity.  The  advantage 
of  this  technique  is  that  an  additional  model  channel  is  not  needed  for 
comparison.  This  scheme  is  applicable  to  sensors  (e.g.,  rate  gyros  and  accel¬ 
erometers)  and  electronic  circuitry,  but  it  is  not  within  the  Btate  of  the 
art  for  application  to  servo  monitoring.  Although  in-line  monitoring  pri¬ 
marily  checks  continuity,  it  cannot  detect  large  drift  or  gain  changes.  The 
signal  frequency  would  be  above  the  control  signal  frequency  band  and  would 
likely  be  sampled  before  the  actuator  output  (e.g.,  at  the  servovalve  spool) 
because  the  actuator  would  filter  it  out .  Now,  if  and  when  the  valve  should 
saturate  because  of  a  momentarily  large  error  signal,  which  would  be  fre¬ 
quent  during  fast  maneuver  such  as  terrain  following  or  in  bumpy  air,  the 
valve  spool  would  go  against  its  stops  and  the  test  signal  would  disappear. 

The  monitor  would  interpret  the  loss  of  signal  as  a  failure.  Hence,  the 
false  alarm  rate  would  be  ridiculously  high.  The  in-line  monitoring  concept 
was  investigated  during  the  project  to  verify  the  conclusion.  A  small  series 
actuator  having  an  LVET  on  the  valve  «pool  was  operated  in  the  laboratory 
under  simulated  normal  conditions.  A  continuous  high  frequency  test  signal, 
ranging  from  Just  above  the  actuator’s  20^ertz  response  limit  to  100  hertz, 
was  injected  along  with  the  command  signal  during  one  test  and  into  the 
actuator  position  transducer  during  another.  Observing  the  teat  signal  at 
the  spool  LVDT  verified  that  the  signal  disappeared  often  and  that  a  false 
alarm  would  occur  each  time.  Therefore,  in-line  monitoring  will  not  be 
considered  further  for  application  to  actuators.  Although  comparison 
monitoring  suffers  the  disadvantage  of  requiring  an  extra  control  channel  for 
references,  it  is  capable  of  detecting  all  failures  causing  differences 
between  channels  above  a  preset  threshold.  Therefore,  it  should  be  used  in 
all  actuator  configurations. 
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The  monitor,  which  consists  of  comparators  and  channel  select  and 
switching  logic,  should  be  so  designed  that  a  failure  within  itself  cannot  pre¬ 
vent  switching  out  a  failed  channel.  An  undetected  monitor  failure  can  be  par¬ 
ticularly  dangerous  in  a  standby  redundant  system  wherein  the  active  channel 
can  fail  hardover  without  being  opposed.  Hence,  the  comparators  should  be  fail¬ 
safe  (i.e.,  self-indicating  of  failures)  so  as  to  properly  arm  the  logic.  A 
good  rule-of-thumb  criterion  for  monitor  reliability  is  that  it  be  at  least  10 
times  as  reliable  as  the  servo  that  it  is  monitoring.  Extending  this  criterion 
to  the  system  level,  the  probability  that  the  monitor  will  cause  a  system 
failure  (through  an  inability  to  detect  a  failure  as  well  as  causing  a  system 
failure)  should  be  one-tenth  the  probability  of  a  system  failure.  This  means 
that  the  comparators,  logic,  solenoids  (if  required),  and  engage  valves  should 
be  fail-safe  or  meet  the  system  reliability  requirement. 

The  monitor  points  in  any  control  system  are  selected  so  as  to 
minimize  failure  transients  and  component  tolerance  accumulation.  For 
convenience,  a  point  Just  prior  to  a  summing  Junction  is  often  used  since  it 
is  the  last  point  where  the  unadulterated  signal  can  be  observed.  Failures 
between  monitoring  points  are  isolated  from  failures  between  any  other 
monitoring  points.  Therefore,  points  are  used  to  isolate  failures.  For 
example,  the  fly -by -wire  system  using  C*  feedback  should  be  monitored  at  the 
actuator  and  at  the  shaped  outputs  of  the  C*  sensors  Just  before  they  sure 
stunned  with  the  command  signal  or  before  they  enter  the  servo  inputs.  This 
isolates  the  sensor  failures  from  the  actuator  failures  thereby  improving 
reliability  and  easing  the  monitoring  tasks.  Monitoring  points  associated 
with  BITE  are  selected  to  isolate  failures  to  a  line  replaceable  unit,  but 
this  is  a  maintenance  aid  Bind  does  not  affect  reliability.  Actiiator  moni¬ 
toring  can  be  performed  at  a  number  of  places:  at  the  error  signal  in  the 
servo  amplifier,  at  the  servovalve  spool  position,  at  the  actuator  (either 
secondary  or  power)  position,  on  differential  pressure  transducers  across 
the  valve  or  actuator,  or  on  output  force  transducers.  The  parameters 
observed  are  actuator  rate,  position,  and/or  output  force.  The  best  moni¬ 
toring  point  (or  points)  will  depend  on  the  actuator  configuration,  but  the 
location  should  meet  the  following  requirements.  To  minimize  transient 
outputs,  the  output  member  should  not  have  to  move  for  failure  detection. 

This  normally  means  that  the  primary  monitoring  point  should  not  be  at  the 
actuator  output.  A  corollary  to  the  rule  iB  that  the  monitor  point  Bhould 
include  as  much  of  the  forward  path  (excluding  the  output  member)  as  is 
possible.  The  result  here  is  rate  monitoring  because  the  last  stage  before 
the  actuator  is  nearly  always  a  flow  control  stage.  Spool  position  moni¬ 
toring  is  popular  for  this  reason.  Load  variations  should  not  affect 
monitor  performance.  This  rule  affects  standby  redundant  configurations  or 
those  using  model  channels.  The  monitor  can  interpret  a  position  or  rate 
variation  due  to  a  large  load  on  the  active  channel  as  a  failure  because  the 
active  and  standby  channels  no  longer  track  each  other.  Monitoring  at  more 
than  one  point  may  be  desirable  in  some  cases  for  added  confidence  by  cor¬ 
relating  signals.  This  approach  would  be  helpful  in  a  r.oisy  signal 
environment . 
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5-  ACTUATOR  CONFIGURATIONS 


A  number  of  known  actuator  configurations  have  been  investigated  which 
are  capable  of  operating  after  double  failures  according  to  the  reliability 
analysis.  The  seven  configurations  listed  do  not  necessarily  represent  an 
exhaustive  survey,  but  data  on  such  actuators  are  extremely  scarce.  A  large 
number  of  configurations  exist  that  are  fail-operational.  However,  the 
designs  generally  are  not  amenable  to  extension  to  high  degrees  of  redun¬ 
dancy  so  they  are  not  considered  here.  Because  the  need  for  an  operational 
capability  after  two  failures  has  Just  recently  been  established,  very  little 
development  work  has  been  done . 


The  configurations  investigated  represent  a  reasonable  cross  section 
of  thinking  on  actuator  design.  This  allows  a  general  comparison  of  advan¬ 
tages  and  disadvantages .  A  direct  comparison  of  size,  weight,  cost,  and 
reliability  was  not  done,  because  the  concepts  are  somewhat  idealized.  The 
seven  configurations  are  as  follows: 


(1) 

(2) 

(3) 

(4) 

(5) 

(6) 
(T) 


Model  1. 

Model  2. 

Model  3. 
Model  4. 
Model  5. 

Model  6. 

Model  7. 


Conventional  standby-redundant  actuator  with  electrical 
monitoring  on  valve  spool  position 

Conventional  standby-redundant  actuator  with  hydraulic 
monitoring  on  valve  spool  position  (Hydraulic  Research) 

Secondary  actuator  with  standby  redundancy  (Weston) 

Fail-passive  secondary  actuator  (Sperry  Phoenix) 

Standby-redundant  actuator  with  electrical  position 
monitoring  (General  Electric) 

Standby-redundant  actuator  with  hydraulic  position 
monitoring  (General  Electric) 

Force-summed  voted  actuator  (Elliott  Brothers) 


The  configurations  are  evaluated  on  the  basis  of  the  tradeoff  factors 
discussed  in  the  preceding  subsection. 

a.  Model  1.  Spool-Konitored  (Electrical)  Standby  Redundant  Actuator 

The  model  1  configuration  (figure  39)  is  described  first  since  it 
utilizes  the  most  familiar  concepts.  The  configuration  uses  three  real 
channels  (identical  within  tolerances)  and  u  model  channel  which  may  be 
hydraulic  or  electronic.  One  real  channel  is  active  while  the  other  two 
operate  in  standby.  Actuator  position  feedback  is  electrical.  The  two- 
stage  servovalves  are  coupled  to  the  actuator  through  a  four-position  engage 
valve  (or  through  2  two-position  engage  valves).  The  engage  valve  transfers 
the  system  througn  its  operational  modes  on  commands  from  the  electronic 
monitor  via  electrohydraulic  solenoids.  Position  transducers  on  the  servo¬ 
valve  spools  and  model  channel  (or  equivalent)  provide  signals  for  comparison 
monitoring.  Complete  channel  isolation  is  maintained.  Failures  are  detected 
without  requiring  actuator  motion  from  the  command  position. 
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For  the  first  failure,  the  systerr  switches  from  the  active  channel  to 
a  standby  channel  unless  the  failure  is  in  a  standby  channel.  In  this  case, 
the  monitor  prevents  that  channel  from  ever  being  engaged.  For  a  second 
failure,  the  system  switches  to  the  remaining  standby  channel.  In  any 
operational  mode,  the  engage  valve  bypasses  the  nonengaged  actuators. 


The  model  1  confirmation  has  the  following  advantages: 

(1)  No  performance  degradation  due  to  failures  since  each  channel 
can  carry  the  load 

(2)  Failure  isolation  maintained 

(3)  Mechanization  easily  expanded  to  higher  redundancy 

(4)  Eliminated  mechanical  linkages 

(5)  Actuator  deviation  is  not  required  for  failure  detection 


The  configuration  has  the  following  disadvantages: 

(1)  Depends  on  solenoid  valve  and  engage  valve  reliability  for 
transfer 

(2)  Fast  transfer  times  require  high  speed  solenoids  and  comparators 
to  minimize  transients 

(3)  Monitor  may  be  sensitive  to  large  power  transients 

J 

(4)  Large  Bize  and  weight  because  each  actuator  must  be  sized  to 
carry  the  full  load 

(5)  Monitor  sensitive  to  large  load  variations  because  of  the 
electronic  model 

(6)  Spool  position  transducer  reduces  valve  performance,  increases 
cost,  and  lowers  reliability 

Comae  nts: 

This  configuration  could  be  designed  for  active  redundancy  using  synchro¬ 
nization  to  eliminate  disadvantages  2  and  4  but  at  the  expense  of  added 
complexity. 
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b.  Model  2.  Spool-Monitored  (Hydraulic)  Standby  Redundant  Actuator 


The  model  2  configuration  is  very  similar  to  model  1  except  for  the 
monitoring  mechanization  which  is  all  hydraulic.  Model  2  uses  four  real 
channels  (identical  within  tolerances)  with  one  acting  as  a  model.  Actuator 
position  feedback  is  electrical.  One  channel  is  active  while  all  others 
are  in  standby.  The  servovalves  are  coupled  to  an  actuator  through  a  four- 
position  engage  valve.  The  engage  valve  transfers  the  system  through  its 
operational  modes  on  commands  directly  from  the  hydraulic  monitor.  Hie 
positions  of  the  servovalve  spools  are  measured  and  compared  hydraulically. 
Complete  channel  isolation  is  maintained.  Failures  are  detected  without 
required  actuator  deviation  from  the  coinnanded  position. 

For  the  first  failure,  the  system  switches  from  the  active  to  a 
standby  channel  unless  the  failure  is  in  a  standby  channel.  In  this  case 
the  monitor  prevents  that  channel  from  ever  being  engaged.  In  any  oper¬ 
ational  mode,  the  engage  valve  bypasses  the  nonengaged  actuators. 

The  configuration  has  the  following  advantages: 

(1)  No  performance  degradation  due  to  failures  since  each  channel 
can  carry  the  load 

(2)  Failure  isolation  maintained 

(3)  Monitor  insensitive  to  load  variations 

(4)  Mechanization  easily  expanded  to  higher  redundancy 

(5)  Eliminates  mechanical  linkages 

(6)  Actuator  deviation  is  not  required  for  faii’ire  detection 

(7)  System  transfer  is  very  fast  because  electrohydraulic  solenoids 
are  not  used 

The  configuration  has  the  following  disadvantages: 

(1)  Depends  on  comparator  and  engage  valve  reliability  for  transfer 

(2)  Hydraulic  comparators  are  not  fail-safe 

(3)  Increased  size  and  weight  because  each  actuator  must  be  sized  to 
carry  the  full  load 

(4)  The  close  electrical  tolerance  required  to  match  channels  for  small 
failure  monitoring  is  costly 

(5)  Hydraulic  logic  is  susceptible  to  silting  effects, 
c.  Model  3*  Secondary  Actuator  With  Standby  Redundancy 

The  model  3  configuration  (figures  40  and  4l)  has  a  small  redundant 
secondary  6orvoaetuator  which  mechanically  drives  the  main  control  valve  and 
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This  configuration  could  be  designed  for  active  redundancy  using  synchro¬ 
nization  to  eliminate  disadvantages  2  and  4  but  at  the  expense  of  added 
complexity. 


i 


l 
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power  actuator  with  nearly  unity  feedback.  The  dual  feedback  linkage  car.  be 
sealed  within  the  actuator  body  where  it  is  protected  and  bathed  in  oil. 

The  power  actuator  employs  active  redundancy.  The  secondary  servo  uses  three 
real  channels  (identical  within  tolerances)  and  a  model  channel  which  may 
be  hydraulic  or  electronic.  One  real  channel  is  active  while  the  others 
operate  in  standby  by  driving  dumny  model  pistons  which  are  sized  to  match 
the  secondary  actuator.  The  feedback  of  the  model  piston  and  the  secondary 
actuator  is  electrical.  The  servovalves  are  coupled  to  the  secondary 
actuator  through  a  four-position  engage  valve.  The  engage  valve  transfers 
the  system  through  it6  operational  modes  on  commands  irem  the  electronic 
monitor  via  electrohydraulic  solenoids.  The  monitor  compares  the  position  of 
the  secondary  actuator  and  model  pistons.  This  eliminates  the  need  for 
servovalve  spool  transduces  and  allows  limited  monitoring  of  the  main  con¬ 
trol  valve  and  power  actuator.  Complete  channel  isolation  is  maintained. 
Failures  are  detected  without  requiring  power  actuator  motion  from  the  com¬ 
manded  position  although  some  motion  will  occur  for  hardover  failures. 

For  the  first  failure,  the  system  switches  from  the  active  secondary 
channel  to  a  standby  channel  unless  the  failure  is  in  a  standby  channel.  In 
this  case  the  monitor  prevents  that  channel  from  ever  being  engaged,  "or  the 
second  failure,  the  system  switches  to  the  remaining  standby  channel.  Channel 
switching  proceeds  as  follows  assuming  an  active  channel  failure.  The  engage 
valve  disconnects  the  active  valve  from  the  actuator  and  bypasses  the 
actuator  while  simultaneously  switching  the  standby  valve  from  its  model 
piston  to  the  secondary  actuator.  Also  simultaneously,  the  monitor  switcher 
the  feedback  of  the  standby  channel  from  its  model  piston  to  the  standby 
feedback  transducer  on  the  secondary  actuator. 

The  configuration  has  the  following  advantages: 

(1)  No  performance  degradation  due  to  failures 

(2)  Failure  isolation  is  maintained  (Model  3B  only) 

(3)  Monitor  insensitive  to  load  variations 

(4)  Mechanization  easily  expanded  to  higher  redundancy 

(5)  Actuator  deviation  not  required  for  failure  detection 

(6)  Servovalve  spool  position  transducers  not  required 

(7)  Small  servovalves  are  adequate 

(8)  Power  servo  channels  are  active  which  minimizes  size 

The  configuration  has  the  following  disadvantages: 

(1)  Depends  on  solenoid  valve  and  engage  valve  reliability  for 
transfer 

(2)  Fact  transfer  times  require  high  speed  solenoids  and  comparators 
to  minimize  transients 
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(3)  Monitor  may  be  sensitive  to  large  power  transients 

(4)  Part  of  secondary  failure  transient  is  transmitted  to  the 
output  through  the  mechanical  linkage 

(5)  Requires  a  secondary  actuator 

(6)  Requires  model  pistons  and/or  an  electronic  model 
d.  Model  4.  Fail-Pas6ive  Secondary  Actuator 

The  model  4  configuration  (figures  42  and  43)  is  described  in 
somewhat  more  (  -tail  because  of  its  unique  characteristics.  It  employs  a 
small  redundant  secondary  actuator  which  mechanically  drives  the  main  control 
valve  and  power  actuator  with  nearly  unity  feedback  (similar  to  model  3)- 
The  dual  mechanical  linkage  can  be  sealed  within  tne  actuator  body  where  it 
is  protected  and  bathed  in  oil.  Both  the  secondary  and  power  actuators 
employ  active  redundancy.  When  dual  hydraulic  supplies  are  used,  the 
secondary  actuator  is  dual  tandem  with  two  single-stage  Jet-pipe  valves 
driving  each  piston  thus  forming  four  inner  servo  loops.  When  triple 
hydraulic  supplies  are  used,  the  secondary  actuator  is  triple  tandem  with  a 
single  valve  driving  each  piston  thus  forming  three  inner  loops. 

The  uniqueness  of  the  configuration  derives  from  the  inner  loops 
which  are  designed  to  have  passive  failure  characteristics.  A  fail-passive 
channel  falls  in  such  a  way  that  it  has  no  output  and  it  does  not  interface 
with  the  normal  operation  of  a  parallel  channel.  In  other  words,  active 
or  hardover  failures  have  been  eliminated  by  design.  Since  a  failed 
channel  has  no  force  output,  the  other  good  channels  can  operate  unimpeded. 

The  single-stage  Jet-pipe  valve  not  only  has  the  proper  failure  character¬ 
istics,  but  it  also  acts  like  a  very  open-centered  valve  so  that  fluid  can 
be  forced  back  through  it  with  relative  ease  thus  preventing  hydraulic  lock. 
The  servo  error  signal  is  formed  in  the  position  feedback  transducer,  rather 
than  in  an  amplifier  as  is  normally  done,  auch  that  a  transducer  failure 
blocks  the  comnand  signal.  This  feature  prevents  the  open  loop  condition 
that  normally  results  from  a  loss  of  feedback.  The  electronics  fall 
passively  because  ac  signals  are  used.  A  hardover  electronic  failure  causes 
a  dc  output  to  which  the  ac  circuits  are  not  sensitive. 

If  a  hardover  input  should  occur  in  a  channel  or  as  an  input,  the 
other  channels  collectively  offset  the  output  force  of  the  failed  channel  at 
the  force -sunning  actuators.  The  high  loop  gains  reduce  the  resulting  position 
offset  to  an  insignificant  level.  Therefore,  a  quadruplex  servo  with  four 
hydraulic  and  electrical  supplies  will  operate  after  three  failures,  and  a 
triplex  servo  will  operate  after  two  failures.  Further,  no  monitoring, 
switching,  or  engage  valves  are  required  in  this  approach.  Monitoring  is 
performed,  however,  primarily  for  failure  reporting.  In  the  triplex  servo, 
a  hardover  monitor  may  be  used  to  provide  center  and  lock,  in  the  event  that 
one  of  the  three  failures  is  not  passive . 

Both  the  fail-passive  triplex  and  quadruplex  servos  have  been  tested 
in  the  laboratory  to  demonstrate  their  operation  and  performance.  The 
quadruplex  servo  operates  slightly  better  than  predicted  by  theory.  This  is 
because  a  failed  servo  does  not  completely  bypass  the  other  channel  on  the 
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Figure  k2 
Model  1*A 
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same  plBton.  Therefore,  after  three  failures,  the  actuator  retains  about  2 0 
percent  of  its  dynamic  performance  which  would  likely  be  enough  to  let  the 
pilot  fly  the  aircraft.  An  important  point  to  note  is  that  the  6ervo  operates 
after  three  failures  without  the  use  of  monitoring  or  switching.  The  lack 
of  switching  not  only  simplifies  the  design  but  it  also  eliminates  the 
failure  transient  problem.  Relatively  simple  monitoring  utilizes  differential 
pressure  transducers  to  measure  the  output  force  of  the  servos.  The  monitor 
correlates  this  information  with  the  error  signals  to  determine  which  chan¬ 
nels  have  failed.  A  final  point  is  that  the  fail-passive  servo  does  not 
require  tight  tolerances  because  it  need  not  be  monitored.  On  the  ex¬ 
perimental  model,  the  tolerances  were  purposely  varied  by  ±30  percent  with 
no  noticeable  effect  on  performance.  This  result  ha6  obvious  advantages 
in  the  economy  of  construction  and  operation. 

The  conf iguration  has  the  following  advantages: 

(1)  No  switching  required  for  failures  thus  eliminating  switching 
transients  and  engage  valves 

(2)  Relatively  simple  monitoring  required  for  failure  reporting 
only 

(3)  A  triplex  system  remains  operational  after  two  failures;  a 
quadruplex  system  remains  operational  after  three  failures;  etc 

(4)  Size,  weight,  complexity  and  cost  are  minimum  for  the  given 
degree  of  redundancy 

(5)  Very  tolerant  to  channel  mismatches 

(6)  Easily  adapted  to  any  degree  of  redundancy 

(7)  Requires  single-stage  valves  rather  than  two-stage  valves 
which  impioves  reliability 

(8)  Very  tolerant  to  dirty  fluid;  can  operate  with  200  micron 
filters 

The  configuration  has  the  following  disadvantages: 

(1)  Requires  a  secondary  actuator 

(2)  May  have  limited  dynamic  performance  and  threshold  in  very  high 
performance  applications  when  using  presently  available  single- 
stage  Jet-pipe  valves 

(3)  The  triplex  configuration  requires  an  electronic  model  to  ensure 
center  and  lock  for  a  third  failure 

(4)  Force  degradation  for  hydraulic  failures 
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e.  Model  5*  Position-Monitored  Standby  Redundant  Actuator 

The  model  5  configuration  employs  three  parallel  position  servo- 
actuators  with  common  outputs  and  an  ele  ronie  model  and  monitoring 
(figure  44) .  Bach  servo  channel  consists  of  an  actuator,  two-stage  servo¬ 
valve,  6ervo  amplifier,  and  dual  LVDT  position  transducers.  The  actuators 
are  tied  together  rigidly  so  that  relative  motion  does  not  occur.  The 
outer  channel  cylinder  bodies  are  connected  through  a  differential  link 
pivoted  at  the  center  where  it  is  attached  to  the  main  actuator  body.  The 
outer  channels  are  normally  active.  The  center  actuator  is  normally  in 
standby;  it  engages  only  if  both  outer  channels  fail.  This  is  a  hybrid 
active/standby  type  of  redundancy. 

Operation  of  the  outer  channels  (A  and  B)  is  normally  like  a  position 
summed  actuator.  The  differential  link  motion  is  small  (caused  by  tolerance 
variations)  if  the  A  and  B  outputs  are  tqual.  Output  motion  equals  the 
average  output  of  A  and  B.  On  failure  ol  either  A  or  B,  the  failed  actuator 
is  bypassed  and  its  link  end  is  locked.  The  outer  channel  then  supplies  the 
output  with  undegraded  performance.  Failure  of  the  second  channel  causes 
its  actuator  to  be  bypassed,  its  end  link  to  be  locked,  and  the  center 
actuator  (c)  to  be  engaged.  Channel  C  then  drives  th"'  load  with  und»graded 
performance.  A  third  failure  centers  and  locks  the  actuator.  The  locks, 
bypass  valves,  and  engege  valves  operate  on  command  from  the  electronic 
monitor  via  electrohydraulic  solenoids.  The  monitor  operates  on  the  actuator 
position  transducer  outputs  aid  the  model  output. 

The  configuration  has  the  following  advantages: 

(1)  No  performance  degradation  after  failures 

(2)  Failure  isolation  is  maintained 

(3)  Mechanization  expandable  to  higher  redundancy 

(4)  Servovalve  spool  position  transducers  not  required 

The  configuration  has  the  following  disadvantages: 

(1)  Output  deviation  required  for  failure  detection 

(2)  Depends  on  solenoid  valve,  bypass  valve,  and  lock  and 
monitor  reliability  for  transfer 

(3)  Fast  transfer  times  require  high  speed  solenoids  and  monitor 
to  minimize  transients 

(4)  Monitor  sensitive  to  large  load  variations  because  of  the 
standby  channels 

(5)  Monitoring  may  be  sensitive  to  large  power  transients 

(6)  Increased  size  and  weight  because  each  actuator  must  be  sized  to 
carry  the  load 
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Comments: 


By  using  the  output  as  a  small  secondary  actuator  to  mechanically  drive 
a  power  actuator  valve,  disadvantages  1,  k,  and  6  could  be  minimized  or 
eliminated. 

f.  Model  6.  Posit  ion -Monitored  (Hydraulic)  Standby  Redundant  Actuator 

The  model  6  conf iguration  shown  in  figure  U5  employe  four 
parallel  position  servoactuators  whose  outputs  are  rigidly  connected  60  that 
relative  motion  does  not  occur.  One  channel  (a)  is  active,  two  channels 
(B  and  C)  are  in  standby,  and  one  channel  (D)  is  a  model.  A  channel  consists 
of  an  actuator,  two-stage  servovalve,  servo  amplifier,  and  LVET  portion 
transducer.  A  series  of  engage  valves  and  locks  connect  the  various  cnannels 
to  the  load,  one  at  a  time,  on  command  from  the  hydraulic  monitor.  The 
actuator  cylinders  are  sleeves  that  move  within  the  main  actuator  body 
against  a  centering  spring  load  except  channel  A  which  is  the  reference 
channel  whose  6leeve  is  fixed.  Porting  between  the  sleeves  and  the  body 
provides  hydraulic  position  comparison  with  the  reference  channel  for  voting. 
Under  normal  conditions  no  relative  motion  occurs.  Upon  failure  of  channel 
A,  relative  motion  occurs  in  all  three  sleeves.  Channel  A  is  bypa6Bed  and  the 
sleeve  of  channel  B  i6  locked  to  the  body  thus  engaging  it  to  the  load  and 
making  it  the  new  reference  channel.  If  any  other  channel  fails  first,  its 
sleeve  alone  moves.  The  resulting  vote  causes  the  actuator  of  that  channel 
to  be  bypassed.  A  third  failure  causes  center  lock  because  of  the  dis¬ 
agreement  of  sleeve  positions. 

The  configuration  has  the  following  advantages: 

(1)  No  performance  degradation  after  failures 

(2)  Failure  isolation  maintained 

(3)  Mechanization  easily  expanded  to  higher  redundancy 

(4)  Servovalve  spool  transducers  not  required 

(5)  Transfer  is  fast  because  electrohydraulic  solenoids  are  not 
used 

The  configuration  ha6  the  following  disadvantages: 

(1)  Output  deviation  required  for  failure  detection 

(2)  Depends  on  engage  valve  and  lock  reliability  for  transfer 

(3)  Silting  may  affect  hydraulic  comparator  performance  by 
increasing  threshold 

(4)  Increased  size  and  weight  because  each  actuator  must  be  sized  to 
carry  the  load 

(5)  Monitor  sensitive  to  large  loao  variations  because  of  the 
standby  channels 
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Comments: 


By  U3ing  the  output  as  a  small  secondary  actuator  to  mechanically  drive 
a  power  actuator  valve,  disadvantages  1,  4,  and  5  ran  .be  minimized  or 
eliminated. 

g.  Model  7-  i*o rce -Summed  Voted  Actuator 

The  model  7  configuration,  shown  in  figure  46,  has  been  developed 
and  tested  by  Elliott  Brothers  of  England.  It  employs  four  separately  con¬ 
trolled  hydraulic  actuators  coupled  in  parallel  to  a  conmon  output  member  by 
means  of  miniature  hydraulic  couplings  combined  with  ball  clutches.  Each 
hydraulic  coupling  has  a  zero  rate  springbox  characteristic,  and  its  stroke 
is  determined  by  the  tolerance  between  channels  necessary  to  allow  for  com¬ 
ponent  variations.  If  failure  causes  the  coupling  to  reach  the  end  of  its 
stroke,  the  balls  disengage  from  a  groove  in  the  conmon  member  and  so 
declutch  the  failed  actuator  from  the  conmon  output.  The  clutch  mechanism 
is  a  variation  of  the  well-known  quick-release  self-sealing  hydraulic 
coupling  which  is  in  widespread  use. 

A  simple  gate  mechanism  is  provided  to  prevent  more  than  two  channels 
from  becoming  disengaged  at  any  one  time.  This  gate  is  required  to  prevent 
disengagement  of  more  than  two  channels  which  might  otherwise  occur  due  to 
some  remote  common  cause,  such  as  an  excessive  output  load  on  the  actuator, 
and  cause  a  loss  of  control.  The  pilot  can  be  warned  of  a  declutched 
actuator  channel  by  means  of  a  failure  display  panel.  The  actuator  remains 
disconnected  from  the  comnon  output  until  the  clutch  is  re-engaged.  This 
is  effected  electrically  by  moans  of  remotely  operated  solenoids  which  are 
operated  from  the  cockpit.  The  real  value  of  the  remote  re-engagement 
facility  is  to  allow  complete  checking  of  separate  control  channels  without 
th  need  for  complex  test  equipment. 

Each  actuator  has  electrical  feedback.  In  addition  a  low-gain 
mechanical  feedback  centers  the  actuator  in  the  event  of  the  loss  of  elec¬ 
trical  power.  The  actuator  centers  automatically  when  either  hydraulic 
supply  is  on,  independent  of  electrical  power.  This  action  is  equivalent 
to  mechanical  spring  centering  which  is  the  conventional  but  heavier  method. 
The  mechanical  feedback  applies  enough  force  to  the  flapper  of  the  servo¬ 
valve  to  cause  the  actuator  to  return  to  the  midposition.  Tbe  gain  of  the 
mechanical  feedback  is  such  that  the  performance  of  the  actuator  is  dominated 
by  the  electrical  feedback  loop. 

The  configuration  has  the  following  advantages: 

(1)  Failure  Isolation  is  maintained 

(2)  Mechanization  flexible  with  respect  to  redundancy 

(3)  Servovalve  spool  transducers  not  required 

(4)  Channel  transfer  is  very  fast  because  elect rohydraulic 
solenoids  are  not  used 
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The  configuration  has  the  following  disadvantages: 

(1)  Output  deviation  (although  very  small)  required  for  failure 
detection 

(2)  Force-voting  mechanism  will  tend  to  get  large  and  heavy  lor 
high  power  actuators 

(3)  Depends  on  voting  mechanism  reliability  for  transfer 


Canments: 

By  employing  the  output  member  as  a  secondary  actuator,  disadvantages 
1  and  2  would  be  eliminated. 

6.  CANDIDATE  SYSTEMS 

The  candidate  fly-by-wire  systems  which  have  evolved  from  analysis 
thus  far  can  be  reasonably  well  defined  with  the  exception  of  the  actuators. 
These  require  further  evaluation  which  will  be  accomplished  through  simu¬ 
lation  techniques  as  will  be  described  in  the  next  section.  Except  for  the 
actuator  configuration  then,  the  jystem  takes  on  the  form  generally  expressed 
in  figures  29 ,  30,  and  31  and  includes  the  following  equipment: 

a.  Spring-centered  control  stick  having  ac  position  transducers 

b.  Mixed  ac  and  dc  electronics,  for  signal  shaping,  summing,  and 
monitoring,  using  both  microcircuits  and  discrete  components 
packaged  in  potted  modules  by  channel 

c.  C*  feedback  utilizing  rate  gyns  and  direct-measuring  normal 
accelerometers  incorporating  self -test  capability 

d.  Series  trim  (preferred) 

e.  Reinforced  copper  wire  transmission  line  protected  by  conduit 
where  necessary 

f.  Triplex  or  quadruplex  redundancy 

g.  Monitor  at  the  actuator  Just  before  its  output  and  at  the  C* 
sensors  Just  before  sunmlng  with  the  conmand  signal 
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While  the  actuator  configuration  analysis  does  not  contain  sufficient 
information  for  an  accurate  comparison  of  reliability,  cost,  weight,  and 
volume,  the  comparison  of  13  relevant  factors  sunmarized  in  table  V  provides 
some  interesting  answers.  Relative  reliability  can  be  gaged  by  factors  4,  9, 
10,  and  12.  The  estimated  number  of  moving  parts  provides  a  clue  not  only  to 
the  relative  reliability  but  to  weight  and  volume  as  well.  Factors  9  and  10 
relate  to  the  ability  of  a  configuration  to  remove  a  failed  channel  which  also 
greatly  affects  reliability.  Factors  8  and  11  are  important  to  the  relative 
cost.  In  particular  tightly  controlled  tolerances  are  expensive  both  in  parts 
cost  and  in  assembly.  Factor  1  shows  that  nil  of  the  configurations  can  get 
down  to  a  30-millisecond  transfer  time  with  a  little  effort.  However,  several 
configurations  beat  this  time  with  no  effort.  The  hydraulic  fluid  filtering 
requirement,  factor  12,  is  another  often  overlooked  design  factor.  Hie 
requirements  range  from  the  3 -micron  filter  on  the  hydraulic  comparators  of 
Hydraulic  Research's  hydrologic  through  the  typical  10-micron  filters  to  the 
50-micron  (plus)  requirement  for  Sperry  Phoenix's  fail-passive  actuator.  The 
argument  for  fine  filtration  is  a  good  one  in  that  very  clean  fluidB  cause 
very  little  if  any  silting,  plugging,  or  Janming  effects.  This  obviously 
improves  reliability.  However,  on  the  other  hand,  the  finer  the  filter,  the 
more  often  it  must  be  replaced. 

A  20-micron  system  filter  is  replaced  about  every  1,000  hours,  and  a 
10-micron  filter  is  replaced  every  100  hours.  Continuing  this  progression 
would  show  that  a  5-,  2-,  and  1-micron  filter  would  require  replacement 
approximately  every  10,  1,  and  0.1  hours  respectively.  This  obviously 
shows  why  5-micron  and  smaller  system  filters  are  seldom  used .  Furthermore, 
while  5-  and  10-micron  particles  can  be  removed  from  the  system,  1-  and 
2-micron  particles  cannot  because  they  are  continuously  being  generated 
within  the  system  (even  if  it  were  sealed)  from  the  seals,  wear,  and  other 
nondescript  sources.  Because  of  the  very  large  population  of  Buch  particles, 
even  filters  which  do  not  have  large  flows,  such  as  in  the  first  stage  of 
the  servovalve,  can  quickly  collect  a  large  quantity  of  particles  and  become 
clogged.  A  system  that  can  operate  in  a  dirty  environment  doee  not  have  the 
replacement  problem. 

The  reasons  for  selecting  the  fail-passive  approach  over  the  others  for 
use  in  fly-by -wire  systems  is  obvious  from  the  table.  It  has  no  failure 
transfer  time,  little  degradation,  the  fewest  number  of  moving  parts  (hence 
by  implication  the  most  reliable,  lightest,  and  smallest),  it  is  the  only 
configuration  that  does  not  depend  on  nonredundant  components  for  switching 
out  failures  (such  as  engage  valves,  solenoids,  or  monitors),  it  is  easily 
the  most  tolerant  of  channel  mismatch  (which  implies  low  cost  and  a  very  low 
nuisance  failure  indication  rate),  and  it  is  also  the  most  tolerant  of  dirty 
hydraulic  fluid. 

Hie  second  and  third  choices  of  actuator  configuration  are  models  2  and  3 
respectively.  Model  2  has  a  very  fast  switch  time  which  is  important 
in  minimizing  airframe  transients.  However,  the  tight  tolerances  required 
may  be  expensive  to  obtain  and  expensive  to  maintain  as  well  since  parameter 
drift  tolerances  must  also  be  small.  A  tradeoff  should  be  possible  between 
longer  larger  failure  transients  and  larger  tolerance  requirements.  Model  3 
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would  be  equally  acceptable  as  model  2  if  the  minimum  transfer  time  were 
achieved.  Hals  would  require  limited  solenoid  development  to  provide  faster 
switching.  The  airframe  response  to  various  switching  tiroes  will  be  demon¬ 
strated  in  the  next  section. 

The  list  of  actuator  models  is  repeated  to  aid  in  using  table  V. 


a. 

Model  1 

Conventional  standby-redundant  actuator  with 
electrical  monitoring  on  valve  spool  position. 

b. 

Model  2 

Conventional  standby -redundant  actuator  with 
hydraulic  monitoring  on  valve  spool  position. 

c. 

Model  3 

Secondary  actuator  with  standby -redundancy. 

d. 

Model  4 

Fail-passive  secondary  actuator. 

e. 

Model  5 

Standby-redundant  actuator  with  electrical  position 
monitoring . 

f. 

Model  6 

Standby -redundant  actuator  with  hydraulic  position 
monitoring . 

g- 

Model  7 

Force-sunned  voted  actuator. 
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TABLE  V 


SUMARY  COMPARISON  OF  ACTUATOR  CONFIGURATIONS 


X  • 

Time  to  detect  and  switch 
out  failures  (milliseconds) 

30- 

100 

4- 

10 

30- 

100 

0 

30- 

100 

10 

10 

2. 

Performance  degradation  after 
one  failure 

No 

No 

No 

No 

No 

No 

25  i 

3- 

Performance  degradation  after 
two  failures 

No 

No 

No 

10$ 

No 

No 

50  lo 

4. 

Mechanical  complexity: 

Number  of  moving  parts 

18 

30 

22 

11 

22 

18 

33 

5. 

Isolated  failures 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

6. 

Mechanically  flexible  to 
redundancy  implementation 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

Yes 

7. 

Output  deviation  required 
for  failure  detection 

No 

No 

No 

No 

Yes 

Yes 

Little 

8. 

Requires  servovalve  spool 
position  transducer 

Yes 

Yes 

No 

No 

No 

No 

No 

9. 

Maximum  allowed  tolerance 
buildup  (percent  channel 
mismatch) 

±20 

±10 

±20 

±50 

±20 

±10 

±20 

10. 

Hydraulic  fluid  filter  required 
(microns) 

10 

2-5 

10 

50+ 

10 

2-5 

10 

Actuator  Configuration  Model 
12  3  4  5  6  7 


Factor 


11.  Monitor  sensitive  to:  Load 
Power  variations 
Dirt 


No  No  No  No  Yes  Yes  Yes 

Yes  No  Yes  No  Yes  Yes  No 

No  Yes  No  No  No  Yes  No 


SECTION  VII 


SIMULATION  STUDY 


1.  BREADBOARD  MODEL 

The  simulation  portion  of  the  fly -by-wire  program  was  done  primarily 
to  evaluate  the  actuator  configurations  discussed  In  Section  VI  and  to 
study  C*  conmand  responses.  By  means  of  analog  simulation,  with  breadboard 
hardware  whe^e  feasible,  the  intention  was  to  verify  operation,  to  discover 
possible  hidden  problems,  and  to  evaluate  the  candidate  systems  with  respect 
to  failure  Induced  transients  and  channel  transfer  times. 

The  block  diagrams  in  figures  47,  48  and  49  show  the  model  3,  4,  and 
2  candidate  systems  respectively  and  their  transfer  equations.  An 
investigation  of  the  model  and  systems  reveals  that  they  differ  only  in  the 
dynamic  performance  of  the  secondary  actuator/oingle-stage  Jet -pipe  valve 
combination,  figure  47,  and  the  two-stage  valve  of  figure  49.  While  this 
is  not  an  obvious  result  vhen  comparing  the  block  diagrams  of  figures  47 
and  49,  the  following  transfer  functions  are  produced: 

From  figure  47 


•  x  Uoo)  (g^)  CTn) 

C*  I  4^55  (12) 

1+  (lOO)  (qq)  (  s  )  (1°) 


*1  5-68750 

cT  '  s  +56.875 

_  400 _ 

*1  S2+  20S  +  400 

*e  _  _ (5.6875)  (400)0 

c*  °  (s  +56.875)  (S2+  20S  +  400) 


(13) 


(14) 


(15) 
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From  figure  49 


(16) 


(17) 


(18) 


A  comparison  of  equations  (15)  and  (l8)  shows  that  differences  occur  in  the 
first  order  breaks  (56.875  versus  500  radians)  and  in  the  gradient.  It  was 
therefore  decided  to  simulate  model  2  through  the  secondary  actuator  approach 
by  increasing  the  break  frequency  by  a  factor  of  10  in  the  secondary  actuator 
simulation.  No  significant  change  in  aircraft  transient  response  occurred. 

Since  the  majority  of  the  simulation  work  to  analyze  and  evaluate  candi¬ 
date  systems  involves  the  actuators,  it  was  decided  to  simulate  as  much  of 
the  system  as  possible  by  analog  computer.  This  results  in  better  flexibi¬ 
lity,  and  breadboard  hardware  is  easier  to  add  as  it  becomes  available.  The 
fail-safe  comparators,  logic,  and  channel  selection  switches  were  implemented 
by  breadboard  hardware.  Figure  50  shows  these  circuits  as  they  were  bread- 
boarded  for  the  simulation.  In  the  background  is  the  analog  patchboard. 
Figure  51  is  a  circuit  diagram  for  the  fail-safe  comparator  (self- 
indicating)  used  in  the  monitor  circuits. 

The  comparator  compares  the  difference  between  two  channel  error  signals 
against  a  reference  and  produces  an  output  only  when  it  has  not  tripped. 

The  action  of  the  comparator  is  obtained  by  employing  an  ac  excitation  signal 
in  addition  to  the  difference  signal  to  the  input  of  operation  amplifier  Ai 
of  figure  51.  The  output  signal  of  Ai  is  then  the  sum  of  the  ac  excitation 
and  the  difference  voltage.  This  signal  is  rectified  to  produce  the  bias 
voltage  necessary  to  keep  and  Tg  conducting  and  the  input  to  the  logic 
circuit  at  ground.  Inputs  which  saturate  failure  within  the  comparator, 

or  loss  of  ac  excitation  results  in  the  loss  of  the  bias  voltage  to  T^  and 
T2,  and  therefore  the  logic  goes  high  and  the  comparator  indicator  goes  off. 
Latching  capability  for  the  comparator  is  produced  by  positive  feedback 
through  the  zener  diodes,  D]_.  Ci  is  adjusted  to  obtain  the  variable  channel 
selection  times  of  10,  25,  and  50  milliseconds.  Due  to  time  seeling  in  the 
euialog  computer  section,  the  switch  time  is  increased  by  a  factor  of  10  for 
coippatjbility .  Figure  52  showa  a  circuit  diagram  for  the  logic  and  switch¬ 
ing  circuits  necessary  to  obtain  two-fail-operational  capability.  The  logic 
elements  are  diode  "hand"  gates  with  transistor  outputs.  The  logic  circuit, 
designed  with  flatpack  microcircuits,  receives  its  inputs  from  the  monitor 
comparator  and  provides  drive  signals  for  the  channel  selection  switches. 
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Figure  51 

Fail-Safe  Comparator 


Figure  52 

Logic  and  Switching  Diagram 


The  relays  employed  In  the  breadboard  model  are  used  only  to  provide  switch¬ 
ing  of  the  high  voltages  present  in  analog  computation  and  would  be  replaced 
by  solid-state  transistor  switches  in  flightworthy  hardware. 

2.  SECONDARY  ACTUATOR  APPROACH 


The  secondary  actuator  (model  3)  approach  to  a  two-fail -operational 
actuator  design  is  a  descendant  of  the  control  systems  employing  series  SAS 
servos  driving  a  main  surface  actuator.  For  application  to  fly -by -wire,  the 
system  must  have  at  least  three  independent  channels  (each  capable  of  driving 
the  surface  actuator)  ana  an  electronic  model  channel.  Monitoring,  logic, 
suid  channel  selection  of  the  standby  channels  end  the  operating  channel  pro¬ 
vide  two-fail-operational  capability  with  positive  center  end  lock  after  a 
third  failure.  Figure  53  shows  an  analog  diagram  for  the  intermediate 
actuator  concept.  Potentiometer  settings  for  the  two  flight  conditions  in¬ 
vestigated  eure  shown  in  ta&le  VI.  The  equations  describing  this  simulation 
are  as  follows: 
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TABLE  VI 


SECONDARY  ACTUATOR  SIMULATION  POTENTIOMETER  SETTINGS 


Pot  Number 

Setting 

Function 

Pot  Number 

Setting 

Function 

1 

0.068' 

31 

0.4 

I 

r 

2 

0.068 

32 

0.2 

J 

3 

0.068 

Limits  on 

33A 

0.282 

HOT 

4 

0.068 

Servo 

33B 

0.127 

14 

5 

0.068 

Amplifier 

34A 

0.4248 

HQ 

6 

0.068 

Current 

34b 

0.0753 

14 

Airframe 

7 

0.068 

35A 

0.282 

HQ 

Dynamics 

8 

0.068j 

35B 

0.0048 

DQ 

9 

0.08  i 

Servo- 

36a 

0.61 

HQ 

HQ  -  High 

10 

0.08 

Valve/ 

36  B 

0.047 

14 

► 

Dynamic 

11 

0.08 

► 

Secondary 

37A 

O.1616 

HQ 

Pressure 

12 

0.08  J 

Actuator 

37B 

0.002 

14 

13 

0.455 

38a 

0.1333 

HQ 

LQ  =  Lew 

14 

0.455 

38B 

0.0305 

DQ 

Dynamic 

15 

0.455 

39A 

0.0725 

HQ 

Pressure 

16 

0.455 

39B 

1.0 

IQ 

17 

0.5 

40A 

0.25 

HQ 

18 

0.5 

40B 

0.25 

IQ, 

19 

0.5 

Secondary 

41 

0.85 

1 

20 

0.5 

Actuator 

42 

0.30 

Inverse 

21 

0.5 

Position 

43 

0.16 

* 

\  Model  Plus 

22 

0.5 

Limit 

44 

0.64 

Shaping 

23 

0.5 

45 

0.8 

4 

24 

0.5 

46 

Variable 

25 

0.4 

47 

0.2 

26 

0.2 

Elevator 

48 

0.2 

27 

0.5 

Plus 

49 

0.1875 

28 

0.5 

Limits 

50A 

0.7679  HQ 

29 

0.2 

on  Rate 

50B 

0.0003 

14 

30 

0.4 

The  following  limits  were  imposed,  on  the  simulated  actuator:  servo  ampli¬ 
fier  (40  ma  limit),  on  the  secondary  actuators  (0.5  inch),  and  on  the 
surface  actuator  rate  (40  degrees/second). 

The  following  assumptions  were  made  in  development  of  the  simulation 
of  the  secondary  actuator  mechanization. 

a.  Triplex  hydraulic  and  quadruplex  electrical  supplies. 

b.  The  artificial  feel  sensors  (rate  gyro,  accelerometer,  and  shaping 
network)  are  triplex  with  monitors  capable  of  providing  the  follow¬ 
ing  control  channels  and  the  model  with  identical  output  signals. 
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^Since  failures  of  the  sensors  were  not  being  investigated,  only  a 
single  unit  was  used  in  the  simulation.) 

c.  The  simulation  results  are  not  significantly  affected  by  connecting 
the  model  pistons  to  operate  as  secondary  actuators  after  a  failure 
rather  then  switching  the  servovalve  from  the  model  piston  to  the 
standby  piston  on  the  secondary  actuator.  Figure  54  6hows  the 
actual  and  the  simulated  switching.  Typical  signals  to  the  surface 
actuator  are  given  for  each  case  to  demonstrate  why  high  response 
characteristics  for  the  secondary  actuator  are  desirable. 

d.  The  scheduled  gain  G  is  constant  for  the  flight  condition  under 
investigation  but  is  varied  for  different  flight  conditions  to 
maximizing  loop  gain. 

e.  The  demodulator,  modulator,  amplifier  and  torquer  are  linear  in  the 
frequency  range  of  interest". 

f .  Linear  two-de  Tee -of -freedom  airframe  dynamics  for  a  typical  high 
performance  aircraft  are  adequate  for  determining  response  transients. 

The  simulation  is  time  scaled  by  a  factor  of  10  to  allow  inclusion  of  the 
higher  order  actuator  dynamics  and  to  allow  longer  effective  switching  times 
for  the  hardware  (comparators)  at  hand. 

The  failures  investigated  in  the  simulation  are  divided  into  two  groups: 
passive  (those  which  produce  no  output  signal),  and  active  (those  which  pro¬ 
duce  hardover  signals).  Examples  of  passive  failures  sire: 

a.  Loss  cf  control  stick  transducer 

b.  Loss  of  hydraulic  supply 

c.  Loss  of  electrical  supply 

d.  Open  electronics  channel 
Examples  of  active  failures  are: 

a.  Loss  of  feedback  transducer 

b.  Stuck  servovalve 

c.  Servo  amplifier  hardcrver 

For  simulation  purposes,  the  passive  failures  are  simulated  as  loss  of  stick 
transducer,  and  the  active  failures  are  simulated  by  the  loss  of  feedback 
transducers. 

Failure -induced  aircraft  transients  are  obtained  for  two  flight  condi¬ 
tions  (high  and  low  dynamic  pressure)  and  three  channel-transfer  times  (10, 

25,  and  50  milliseconds).  Figures  55  through  58  present  the  time  histories 
of  selected  variables  at  the  low  dynamic  pressure  flight  conditions. 
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Comparison  of  Actual  Switching  and  Simulated  Switching 
in  the  Secondary  Actuator 


Channels  1,  2,  and  3  present  the  input  cotnn&nd  to  the  surface  actuator  from 
control  channels  1,  2,  and  3  respectively.  Channel  4  shove  the  actual  ele¬ 
vator  position.  Airframe  normal  acceleration  and  pitch  attitude  rate  are 
shown  on  channels  5  and  6.  Figures  55>  and  57  ahow  the  influence 
of  channel  selection  time  on  aircraft  transient  for  passive  failures.  It  is 
obvious  when  comparing  the  resulting  aircraft  transient,  that  channel  selec¬ 
tion  time  is  noA  critical  for  low  dynamic  pressure  flight  conditions.  Refer¬ 
ence  to  aircraft  transient  on  figures  58,  59>  and  60,  presenting  the 
influence  of  channel  selection  time  on  active  failures,  again  shows  that 
channel  selection  is  not  critical  at  low  dynamic  pressures.  The  data  on 
figures  55  through  58  also  demonstrate  the  benefit  of  the  C*  feedback 
technique.  A  comparison  of  the  step  response  at  t  =  0,  where  C*  is  employed, 
and  the  effective  step  response  resulting  from  a  third  failure  due  to  center 
and  lock  of  the  actuator,  where  C*  is  no  longer  available,  shows  that  the 
dynamic  response  of  the  airframe  is  appreciably  improved  by  the  artificial 
feel  package.  This  does  not  mean  that  a  pilot  could  not  fly  the  aircraft  at 
low  dynamic  pressures  without  artificial  feel,  but  that  much  less  pilot  effort 
would  be  required  through  the  benefits  derived  from  C*  feedback. 

Figures  6l  through  66  present  time  histories  of  the  same  flight  variables 
presented  at  low  dynamic  pressure,  at  the  high  dynamic  pressure  flight  con¬ 
dition.  This  flight  condition  is  the  critical  region  with  respect  to  air¬ 
frame  transients  and  channel  selection  time  because  aerodynamic  forces  and 
moments  produced  by  small  surface  deflections  are  large.  The  aircraft  is 
then  highly  responsive.  Figures  6l,  62,  and  63  present  the  airframe  transient 
resulting  from  passive  failures  with  10,  25,  and  50  millisecond  channel 
selection  times. 

The  dete-'t/engage  aircraft  transients  are  reduced  from  0.2  g  and  0.1  g  in 
normal  acceleration  and  from  1.5  degrees  each  second  to  O.f  degree  each  second 
j .n  pitch  rate  by  reducing  the  channel  selection  time  from  50  milliseconds  to 
10  milliseconds.  The  10-millisecond  channel  selection  time  still  results  in 
normal  acceleration  transients  greater  than  those  considered  acceptable 
(0.02  g)  for  advanced  commercial  aircraft.  Figures  63,  64,  and  65  present 
airframe  transients  resulting  from  active  failures.  The  transients  in  normal 
acceleration  and  pitch  rate  are  directly  comparable  to  those  resulting  from 
passive  failures.  This  result  is  pessimistic  since  linear  airframe  dynamics 
are  assumed,  and  acceleration  limiting  i6  not  included.  Again,  as  at  the 
low  dynamic  pressure  region,  the  effects  of  C*  feedback  can  be  observed  by 
comparing  the  initial  step  response  at  t  ■  0  to  that  occurring  as  a  result 
of  the  third  failure  producing  actuator  center  and  lock. 

At  the  high  dynamic  pressure  condition,  the  artificial  feel  produces  a 
larger  effect  in  changing  the  aircraft  damping  than  it  does  in  changing  the 
aircraft  speed  of  response.  This  result  is  expected  since  the  effective 
control  frequency  of  the  aircraft  is  a  function  dynamic  pressure.  In  the  high 
dynamic  pressure  region,  the  control  response  meets  the  C*  response  criteria 
except  for  the  damping  ratio. 

The  results  of  the  simulation  of  the  secondary  actuator  approach  to  fly- 
by-wire  implementation  indicate  that  the  actuator  design  meets  all  design 
criteria  providing  the  failure-induced  airframe  transients  are  acceptable. 

This  actuator  configuration  provides  double  failure  operation  with  positive 
center  and  lock  capability  if  a  third  failure  occurs.  Airframe  transients 
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Figure  57 

Secondary  Actuator  at  Low  Itynamic  Pressure,  50  ms  Svitch/Open  Input 
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Figure  58 

Secondary  Actuator  at  Low  Dynamic  Pressure,  10  ms  Svitch/Open  Feedback 
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Figure  6l 

Secondary  Actuator  at  High  Dynamic  Pressure,  10  ms  Switch/Open  Input 
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Figure  62 

Secondary  Actuator  of  High  Dynamic  Pressure,  25  ms  Switch/Open  Inpu+ 
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Figure  63 

Secondary  Actuator  at  High  Dynamic  Pressure,  50  ms  Switch/Open  Input 
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Figure  65 

Secondary  Actuator  at  High  Dynamic  Pressure,  25  ms  Svitch/Open  Feedback 
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Figure  66 

Secondary  Actuator  at  High  Dynamic  Pressure,  50  ms  Svitch/Open  Feedback 
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resulting  from  failure  detection  and  channel  engagement  exceed  those  that  the 
aircraft  Industry  has  set  for  advanced  consaercial  aircraft  such  as  the  super¬ 
sonic  transport.  However,  the  0.02  g  transient  level  for  conmerclal  aircraft 
primarily  concerns  passenger  comfort  and  Is  set  to  prevent  the  passengers 
from  detecting  any  control  system  failure  through  the  airframe  responses. 
Comfort  of  ride  at  this  low  g  level  and  passenger  failure  awareness  are  not 
problems  In  military  aircraft.  Hence,  a  0.1  to  0.2  g  transient  would 
probably  be  acceptable  in  military  aircraft  especially  If  this  transient  level 
only  occurred  at  maximum  dynamic  pressure. 

3-  THE  FAIL-PASSIVE  ACTUATOR  APPROACH 

The  fail-passive  secondary  actuator  (model  4)  approach  to  a  two-fail- 
operational  actuator  design  is  a  Sperry-pioneered  design.  The  design 
objective  is  to  optimize  the  application  of  the  redundancy  necessary  to  pro¬ 
vide  double  failure  operation  with  improvements  in  reliability  and  maintain¬ 
ability.  Figures  67  and  68  show  the  electronic  and  hydraulic  breadboard 
developed  on  company  funds  to  analyze  and  evaluate  fall -passive  designs. 

The  system  utilizes  position  servos  in  which  the  electronic  amplifiers, 
hydraulic  servjvalves,  actuators,  and  position  transducers  can  be  made  redun¬ 
dant  to  various  degrees  by  changing  a  few  simple  electrical  and/or  mechanical 
connections.  A  simple  aircraft  simulator  and  servo-driven  rate  table  were 
also  fabricated  to  allow  the  demonstration  of  the  fail-passive  characteristic 
of  a  rate  autopilot.  With  the  addition  of  a  normal  accelerometer,  this 
system  would  be  identical  to  the  fly-by-wire  system  using  C*  feedback. 

The  electronics  test  bed,  shown  in  figure  67,  is  composed  of  thr^e 
complete  rate  autopilot  channels  of  electronics  (a  fourth  channel,  not  shown, 
is  also  available).  Each  channel  contains  means  for  injecting  faults.  A 
simple  aircraft,  consisting  of  an  analog  computer  and  a  servo-driven  rate 
table,  allows  the  demonstration  of  closed-loop  operation  of  the  autopilot. 

The  electrohydraulic  test  bed,  shown  in  figure  68,  is  composed  of  three 
actuators  on  which  Jet-pipe  valves  are  mounted.  Provision  is  made  for 
mounting  two  valves  on  each  actuator  to  demonstrate  the  fall-passive  charac¬ 
teristics  of  dual  valve  actuator  systems.  Each  actuator  is  instrumented  with 
differential  pressure  transducers  for  monitoring  the  pressure  across  the 
piston. 

The  actuators  are  shown  in  the  force  summation  configuration.  The  load¬ 
ing  fixture  sums  the  actuator  outputs  through  short,  rigid  links  attached  to 
a  common  output  shaft.  Thus,  the  actuators  have  a  common  position  and  their 
output  forces  are  summed.  The  output  shaft  is  impleiaented  with  synchro  posi¬ 
tion  feedback.  Each  actuator  can  be  disconnected  so  that  any  combination  of 
actuators  can  be  operated  at  any  one  time.  A  fourth  rigid  link  orthogonal 
to  the  output  shaft  is  provided  for  attaching  various  spring  and  damper  loads 
to  the  actuators. 

The  fail-passive  concept  for  fly-by-wire  application  required  three 
active  and  independent  channels  force  summed  at  a  secondary  actuator. 
Monitoring  is  required  to  provide  positive  center  and  lock  capability  and  for 
failure  reporting,  an  analog  diagram  for  the  fail-passive  actuator  simula¬ 
tion  is  shown  in  figure  69.  Potentiometer  settings  for  the  two  flight 
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Figure  67 

Electronics  Test  Bed 
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Figure  68 

Electrohydraulic  -Test  Bed 


169 


conditions  investigated  are  shown  in  table  VII.  The  equations  describing 
the  simulation  are  as  follows: 
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Figure  69 

Fail-Passive  Actuator  Concept 
Analog  Diagram 
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TABLE  VII 


FAIL-PASSIVE  ACTUATOR  SIMULATION  POTENTIOMETER  SETTINGS 


Pot  Number 

Setting 

Function 

Pot  Number 

Setting 

Function 

1 

1.0  " 

Channel  Match 

27 

0.2 

H 

Forward 

2 

1.0 

1 

28 

0.2 

I1 

Model  Plus 

3 

1.0 

\ 

29 

Variable J 

Input  Command 

4 

0.068' 

Servo  Amplifier 
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Flow  Feedback 

38b 
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IQ 
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HQ 
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Actuator  Position 

39B 

0.0003 
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Dynamic 
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0.4 

43B 
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26 

BEK 

44A 
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HQ^ 

■ 
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The  following  limits  were  imposed,  on  the  simulated  actuator:  servo  ampli¬ 
fier  (40  ma),  the  intermediate  actuator  rate  (2-5  inches/ second) ,  inter¬ 
mediate  actuator  position  (0.5  inch),  and  surface  actuator  rate  (40  derrees/ 
second) . 

The  following  assumptions  were  made  in  the  development  of  the  simulation 
for  the  fail-passive  actuator  mechanization. 

a.  Triplex  hydraulics  and  quadruplex  electrical  supplies. 


b.  The  artificial  feel  sensors  are  a  nonredundant  unit. 


c.  The  scheduled  gain  G  Is  constant  for  the  flight  condition  under 
investigation  but  is  varied  for  different  flight  conditions  to 
maximize  loop  gain. 

d.  The  demodulators,  modulators,  amplifiers  and  torquers  are  linear 
in  the  frequency  range  of  interest. 

e.  Linear  two-degree  -of  -freedom  airframe  dynamics  for  a  typical  high 
performance  aircraft  are  adequate  for  determining  response 
characteristics . 

Time  scaling  by  a  factor  of  10  is  employed.  The  hydraulic  power  to  a 
failed  channel  is  not  shut  off  in  the  simulation,  resulting  in  a  one -third 
loss  in  dynamic  response  of  the  intermediate  actuator  per  failed  channel. 

An  improvement  in  dynamic  response  of  the  intermediate  actuator  results  if 
the  hydraulic  power  to  a  failed  channel  is  shut  off.  A  thorough  discussion 
of  this  actuator  design  and  its  failiwe  modes  was  presented  in  Section  VI. 

The  monitors  are  not  simulated  since  failure  reporting  or  switching  is  not 
done. 

Only  passive  failures  are  investigated  in  the  simulation.  The  tran¬ 
sient  and  performance  degradation  for  active  failures  are  very  similar  to  that 
which  results  for  passive  failures.  Further,  the  relative  probability  of  an 
active  failure  is  only  0.15  percent.  Figures  70,  71  and  72  present  time 
histories  of  selected  aircraft  variables  in  response  to  a  step  stick 
displacement.  Channels  1  and  2  show  C*c  and  the  resulting  C*.  Elevator 
rate  and  position  are  shown  on  channels  3  and  4.  Channels  5  and  6  show 
aircraft  normal  acceleration  and  pitch  attitude  rate.  The  aircraft  is  at  the 
low  dynamic  pressure  flight  condition. 

Figure  70  demonstrates  the  operation  of  the  fall-passive  actuator  in 
response  to  a  step  stick  displacement  with  no  failures.  It  can  clearly  be 
observed  in  this  figure  that  no  airframe  transients  result  from  the  failures 
which  occur  at  t  »  3  and  t  -  7  seconds.  This  result  bears  out  the  theory 
and  laboratory  test  on  the  system  for  a  static  condition.  Figures  71  and 
72  are  step  responses  under  conditions  of  one  and  two  failures  respect ively. 

A  comparison  of  these  responses  and  those  of  figure  70  show  that  the 
dynamic  performance  of  the  actuator  did  not  observably  degrade  the  aircraft 
response  to  any  degree.  Figures  73  and  74  show  time  histories  of  the 
fail-passive  actuator  scheme  when  responding  to  1  hertz  (which  corresponds 
to  very  fast  coomand  signals)  and  4  hertz  (which  corresponds  to  a  stability 
augmentation  signal  frequency)  input  signals  respectively.  At  1-hertz  input 
signal,  essentially  no  degradation  in  performance  could  be  observed  under 
the  failed  conditions.  However,  the  elevator  rate  at  the  4-hertz  input 
showed  about  10  percent  degradation  in  magnitude  with  one  failure  and  almost 
5C  percent  degradation  with  two  failures.  As  the  command  frequency  is  in¬ 
creased,  the  percentage  degradation  will  also  increase. 

Figures  75  and  79  show  the  time  responses  of  the  fail-passive 
actuator  at  the  high  dynamic  pressure  flight  condition.  A  comparison  of 
figures  75,  76  and  77  shows  essentially  no  change  in  dynamic  performance 
of  the  aircraft  with  two  channel  failures .  Again  as  at  the  low  dynamic 
pressure  region,  failures  which  occur  when  the  system  is  in  a  static 
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Fail-Passive  Actuator  at  Low  Dynamic  Pressure  One  Failure 
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Figure  72 

Fail-Passive  Actuator  at  Low  Dynamic  Pressure  Two  Channels  Failed 


COMMAND 


ELEVATOR  RATE 
(DEGREES/SECOND) 


ELEVATOR  POSITION 
(DEGREES) 


0.8  - 
0  - 
-0.8  - 

1 

1.8  - 
0  - 
-1.8  - 


iiiniiiiiiiiiiiiiiii 

iiiiiiipiiifliiflsisii 

Mmux'MLWMzmzmzmLmzimwi 


mwiiwMmiHMi 


FIRST  FAILURE 


SECOND  FAILURE 


in  wwmwmrarmrymrmnm'imm 
■H/ifif/ an  an  mu  mti  aimimm 
Emu  it n  m  iri  in  ■  !  ■  i  mi  n 
■  iiiiiiiiiiiiiif ill  i  ll  hi  ii  mm 
IIIIIIHItllltllllVIil  ■■■■■■  SSSJ 

In  it  \  uii  in  ill  ill  ms  in  mam 
■mum  wm  w  tvtsu  s\i  m  vssi 
ft«immmimmi.mk«wmumam^l 


0.2 

NORMAL 

ACCELERATION 

0 

(G) 

-0.2 

2.0 

PITCH  ATTITUDE 

RATE 

0 

(DEGREES/SECOND) 

-2.0 

0 


,  »  \  1  \  »  \  »  \ 

2  4  8  8  10 

TIME  (SECONDS) 


Figure  73 

Fail-Passive  Actuator  at  Low  Dynamic  Pressure  1-Hertz  Input 
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Fail-Passive  Actuator  at  Low  Dynamic  Pressure  U-Hertz  Input 
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Fail-Passive  Actuator  at  High  Dynamic  Pressure  One  Failure 
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Figure  77 

Fail-Passive  Actuator  at  High  Dynamic  Pressure  Two  Channels  Failed 
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condition  result  in  no  airframe  transients.  Figures  78  and  79  show  time 
response  for  l-hertz  and  4-hertz  command  signals.  These  results  are  similar 
to  those  at  the  low  dynamic  pressure  region  in  that  no  degradation  is  evident 
at  1  hertz  while  50  percent  degradation  in  surface  rate  results  from  two 
failures  at  4  hertz. 

The  results  of  the  simulation  demonstrate  that  the  fail-passive  actuator 
meets  all  of  the  requirements  for  a  fly-by-wire  system  that  remains  opera¬ 
tional  after  double  failures.  No  system  performance  degradation  occurs  in  the 
normal  pilot  control  frequency  range,  but  up  to  5®  percent  degradation  occurs 
at  the  augmentation  frequencies.  The  requirement  for  remaining  operational 
after  double  failures  refers  to  the  flight  control  system  not  to  the  actuator. 
While  the  fail-passive  actuator  does  become  degraded  somewhat  due  to  fail¬ 
ures,  system  performance  is  not  noticeably  affected.  This  result  is  one  of 
the  features  of  the  C*  command  system  as  discussed  in  Section  III.  A  loss  of 
hydraulic  power  was  not  simulated.  Presumably  such  a  failure  would  have  a 
more  noticeable  affect  on  performance  where  active  redundancy  is  employed 
them  would  a  control  channel  failure.  Another  factor  to  consider  is  that  a 
very  high  performance  aircraft  such  as  the  F-lll  has  been  simulated.  „  Degra¬ 
dation  would  be  less  noticeable  on  a  lower  performance  aircraft. 

The  fail-passive  actuator  has  several  advantages  which  far  overshadow  the 
slight  degradation  in  performance  with  failures.  For  fly-by-wire  application, 
three  active  channels  provide  a  two-fail-operational  system  with  no  require¬ 
ments  for  switching.  The  fail-passive  actuator  design  can  include  switching 
for  pilot  channel  selection  and  for  improving  system  performance  upon 
failure  indication,  but  these  switches  are  not  necessary  for  two-fail- 
operational  capability.  Additional  benefits  are  derived  from  the  system 
capability  to  withstand  failures  without  causing  an  aircraft  transient. 


183 


COMMAND 


C 


♦ 


ELEVATOR  RATE 
(DEGREES/SECOND) 


2.0 

0 


-2.0 


-iTRTFFf 


i  i  i  I 


ELEVATOR  POSITION 
(DEGREES) 


NORMAL 

ACCELERATION 

(G) 


PITCH  ATTITUDE 
RATE 

( DEGREES/SECOND) 


\  •  \  »  \  *  \  *  \  » 

0  2  4  (1 


TIME  (SECONDS) 


mi 


Figure  78 

Fail-Passive  Actuator  at  High  Dynamic  Pressure  1-Hertz  Input 
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SECTION  VIII 


COMPARISON  OF  MECHANICAL  AND  FLY-BY- WIRE  SYSTEMS 

Three  aircraft,  the  B-52H,  F-lll,  and  CH-46,  were  chosen  as  test  aircraft 
to  compare  their  mechanical  control  systems  with  equivalent  fly-by-wire 
systems.  These  aircraft  represent  a  cross  section  of  the  various  classes  of 
aircraft  in  service  today,  that  is,  the  heavy  bomber  or  transport,  the  high 
performance  fichter/interceptor,  and  the  VTOL  aircraft.  The  comparison  is 
based  on  cost,  weight  and  space  only  for  the  B-52H  and  F-lll,  since  relia¬ 
bility  and  maintainability  data  are  not  readily  available.  Weight  and  cost 
of  the  structural  parts  were  determined  from  their  volume,  estimated  total 
aircraft  weight,  and  estimated  total  aircraft  cost.  The  comparison  for  the 
CH-46  is  based  on  cost,  weight,  reliability,  and  maintainability.  The 
volume  of  the  existing  control  system  is  not  known. 


B-52H 


Cost /cubic  inch 


dollars  pound 

25.00  - —  x  0.1219  — r: — TT 

pound  cubic  inch 

3.04  dollars/cubic  inch 

pound 
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cubic  inch 


.  dollars  pound 
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1.  B-52H  FLIGHT  CONTROL  SYSTEM 

The  elevator  control  system  on  the  B-52H  aircraft,  figure  80,  is  a 
manually  operated  cable  system  employing  two  aerodynamic ally  and  statically 
balanced,  tab  operated,  floating  surfaces.  Control  movements  are  transmitted 
from  the  pilot’s  or  copilot's  control  column  through  column  disconnect 
mechanisms  to  their  respective  control  cable  quadrants.  The  independent 
control  cables  are  bussed  together  fore  and  aft  at  the  control  cable  quad¬ 
rants  arl  torque  tube  mounted  tension  regulators  respectively.  Also  attached 
to  the  torque  tube  are  autopilot  servo  quadrant,  q-spring,  and  control  tab 
linkage.  Control  tabs,  limited  in  travel  to  ±20  degrees  by  gust  dampers, 
are  located  on  each  independently  hinged  elevator  half  and  are  mechanically 
bussed  together  by  the  control  tab  linkage.  This  technique  results  in 
identical  motion  of  the  elevator  halves  with  low  pilot  effort.  The  q-spring 
produces  a  "feel"  force  as  a  function  of  indicated  airspeed  to  eliminate  o,rer- 
control  of  the  aircraft  by  the  pilot. 
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A  list  of  control  system  oasic  components  used  to  determine  the  weight, 
space  and  equivalent  costs  for  the  B-52H  elevator  control  system  follows: 

Pilot,  copilot  control  column 
Column  disconnect 
Cable  control  quadrant 
Cable  (3/l6  inch  diameter) 

Tumbuckle 

Pushrods  (5/8  inch  diameter) 

Pulleys 

Elevator  torque  tube 
Cable  tension  regulator 
AFCS  cable  quadrant 
Gust  damper 

Figure  8l  shows  a  fly-by-wire  equivalent  of  the  B-52H  elevator  control 
system.  Quadruplex  position  transducers  on  the  cortrol  column  and  elevator 
torque  tube  prov'de  command  and  feedback  signals  respectively.  Trim,  arti¬ 
ficial  feel  and  AFCS  signals  terminate  in  the  control  electronics  unit. 

The  entire  system  is  quadruplex  with  operation  set  up  for  dual  power  sources. 
The  fly-by-wire  equivalent  replaces  the  mechanical  system  only  between  the 
control  column  and  the  torque  tube  to  minimize  installation  problems  asso¬ 
ciated  with  placing  an  actuator  in  a  position  to  control  motions  of  a  control 
tab. 


Table  VIII  presents  the  weight,  volume  and  cost  figure  for  each  of  the 
components  of  th-.  B-52  elevator  control  system  and  its  fly-by-wire  equivalent. 
The  fly-by-wire  quivalent  costs  approximately  twice  as  much  as  the  mech¬ 
anical  system,  but  results  in  a  weight  savings  of  125  pounds  and  a  space 
nnvings  of  P65  cubic  inches. 

The  spoiler  control  system  on  the  B-52H  aircraft,  figures  82  and  83, 
is  a  manually  operated  system  with  control  motion  originating  at  either  the 
pilot's  or  copilot's  control  wheel.  Control  wheels  are  bussed  together  by 
cables  at  both  the  control  wheel  drums  and  the  rear  spar  drums.  Control 
motions  arc  applied  to  metering  valves  which  cause  the  lL  spoiler  actuators 
to  extend  or  retract.  On  eech  wing,  the  four  outboard  spoilers  are  linked 
together  and  called  group  A;  the  three  inboard  spoilers  are  linked  to¬ 
gether  and  called  group  B.  Only  one  followup  linkage  (feedback  member)  is 
used  for  each  group.  Lateral  trim  and  AFCS  electrical  signal  drive  trim 
actuators  and  AFCS  servo  drums  respectively  which  are  connected  to  the 
spoiler  actuate  metering  valves  through  cables.  The  lateral  mechanical  con¬ 
trol  system  is  made  up  of  the  following  principal  components: 

Pilot  and  copilot  control  wheel 

Control  wheel  drum 

Cables 

Turribuckles 

Pulleys 

Rear  spar  drum  (lower  and  upper) 

Servo  motor  drum  (AFCS  drum) 

PushrodB 

Tension  regulator 
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Figure  8l 

-52H  Elevator  Control  System  (Fly-By-Wire) 
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TABLE  VIII 

►“52H  ELEVATOR  CONTROL  SYSTEM  WEIGHT  AND  COST 
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48 

9.216 

150.72 

480 

4 

0.768 

12.56 

4o 

% 

7.0 

28 

7.81 

32.2 

196 

2 

0.558 

2.30 

14 

t 

4.0 

70  ft 

11.27 

92.4 

280 

35  ft 

5.64 

46.2 

140 

316.0 

1 

12.7 

104 

316.0 

1 

12.7 

104 

316.0 

354.0 

2 

27-6 

226.0 

708 

— 

— 

— 

— 

438. 

1 

17-5 

?44 

438 

— 

* 

— , 

— 

74.5 

2 

5.8 

49.0 

149.0 

2 

5.8 

49.0 

149.0 

60.8  ea 

10 

24.5 

200 

608 

8 

19.60 

160 

486.40 

100.0 

— 

— 

— 

— 

8 

1.0 

10.0 

8000 

2000 

— 

— 

— 

— 

4 

5 

80 

— 

5000.0 

— 

— 

— 

— 

1* 

7.2 

0.60 

5000.0 

'ft 

0. 10/ft 

— 

— 

— 

570 

13.10 

53.58 

57.0 

191.0 

— 

— 

— 

1 

7.62 

_ j 

62.6 

191.0 

1500 

1 

5.80 

47.7 

1500 

— 

1 

1 

1 

1 

1 

1 

1 

1 

a 

— 

— 

287.IO 

2228.8 

8054.87 

— 

160.66 

1363.82 

17,203.5 

M 
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Figure  83 

-52H  Spoiler  System  (Mechanical) 


Inboard  differential 
Outboard  differential 
Trim  cable  drum 
Centering  torsion  bar 
Metering  valve 
Spoiler  actuators 

Figure  84  shows  the  fly-by-vire  equivalent  of  the  mechanical  P-52H 
spoiler  control  system.  Quadruplex  position  transducers  at  the  control  wheel 
provide  roll  command  signals  to  the  servovalves  which  drive  the  spoiler 
actuators.  Mechanical  feedback  to  the  valves  is  employed  as  in  the  original 
system.  Trim,  AFCS,  airbrake  and  manual  control  signals  are  summed  at  the 
control  electronics. 

Table  DC  presents  the  weight,  volume,  and  cost  of  the  original  B-32H 
spoiler  system  and  for  the  fly-by-wire  equivalent.  The  fly-by-wire 
equivalent  costs  approximately  twice  as  much  as  the  mechanical  system,  but  it 
results  in  a  weight  savings  of  155  pounds  and  a  space  savings  of  1195  cubic 
inches. 

The  rudder  control,  system  on  the  B-52H,  figure  85,  is  a  manually 
operated  cable  system  employing  an  aerodynamieally  and  statically  balanced, 
tab  operated  surface.  Control  movements  are  generated  by  operation  of  the 
rudder  pedals  from  either  the  pilot's  or  copilot's  station.  The  left  and 
right  hand  rudder  pedals  are  bussed  together  fore  and  aft  at  the  control 
quadrants  and  torque  tube  mounted  tension  regulators  respectively.  Also 
attached  to  the  torque  tube  are  autopilot  servo,  q-spring  for  artificial 
feel,  and  rudder  trim.  Control  motions  are  transmitted  to  the  rudder  con¬ 
trol  tab  by  additional  bellcranks  and  linkages.  An  additional  tab  (stabi¬ 
lizer  tab)  is  picked  up  when  large  deflections  are  commanded.  The  mechanical 
rudder  system  is  made  up  of  the  following  list  of  major  components: 

Pilot  and  copilot  rudder  pedals 
Rudder  control  cable  quadrants 
Cables  (3/16  inch) 

Pushrods 
Turnbuckles 
Torque  tube 

Cable  tension  regulator 
AFCS  servo  quadrant 
Trim  actuator 
Gust  damper 
Aft  torsion  bar 

F  tgure  86  shows  a  fly -by-wire  equivalent  of  the  B-52H  rudder  control 
system.  The  system  employs  quadruplex  position  transducers  for  yaw  command 
signals  and  actuator  feedback  signals.  Quadruplex  electronics  and  servo 
amplifiers  are  used  to  provide  two-failure  operation.  AFCS  and  trim  signals 
electrically  rum  with  the  conmand  signal  in  the  control  electronics,  but  the 
stability  augmentation  and  gust  damper  remain  mechanical.  The  fly -by -wire 
equivalent  replaces  all  of  the  mechanical  linkages  between  the  rudder  pedals 
and  the  control  linkages  in  the  vertical  fin. 
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Figure  8L 

-52H  Roll  Control  System  (Fly-By -Wire ) 


TABLE  IX 


B-52H  roll  control  system  weight  ant  r c 


Control  System 

Individual 

Mechanical  3y 

Component 

Weight 

(lb) 

Volume 

(in. 3) 

Cost 

(dollars^ 

Number 

Weight 

(lb) 

E 

Control  Wheel 

24.9 

204.9 

621.0 

2 

49.8 

1 

Control  Wheel  Drum 

9-79 

77.2 

235.0 

C 

19.58 

■ 

Cable  (3/l6  in.  Diameter) 

0.084 /ft 

0-332 /ft 

0.505 /ft 

360  ft 

30.24 

1 

Turnbuckles 

0.279  ea 

1.15  ea 

7*00  ea 

44 

12.276 

5 

Pulleys  (4  to  6  in.  Diameter) 

0.192 

3-24  ee 

10.00  ea 

32 

6.144 

1 

Rear  Spar  Drum 

9.18 

75-5 

229.0 

2 

18.36 

1 

AFCS  "Servo"  Drum 

O.Q56 

7.85 

23.9 

1 

0.956 

7 

Pushrods  (5/8  in.  Tube) 

c.±6i/ft 

1.32/ft 

4.0/ft 

36  ft 

5.796 

1 

Cable  Tension  Regulator 

4.81 

39.3 

119.0 

2 

9.62 

7 

INBD  Differential 

12.8 

105.4 

319.0 

2 

25.6 

2 

OUTD  Differential 

9.65 

78.1 

241.0 

2 

15.3 

1 

Trim  Servo  Drum 

0.956 

7.85 

2?-9 

1 

0.956 

1 

Centering  Torsion  Bar 

3.81 

31.32 

95.0 

2 

7.62 

6 

Spoiler  and  Airbrake 

Metering  Valve 

3.41 

42.0 

780.0 

8 

27.28 

3 

Spoiler  Actuators 

1.94 

15.96 

300.0 

14 

27.16 

2 

Over  Travel  Cart 

7.90 

64.8 

197.0 

4 

31.6 

2 

Position  Transducer 

0.37  ea 

10 

100.0 

— 

— 

Control  Electronic/Channel 

Servo  Amplifier 

1.25  lb 

20 

2000.0 

— 

— 

1 

Control  Valve* 

2.42 

24.0 

2500 

— 

— 

*Redundant  (Hydraulic)  Servo. 

TABLE  DC 


?H  ROLL  CONTROL  SYSTEM  WEIGHT  AND  COST 


Mechanical  System 


Cost 

(dollars ) 


621.0 


235.0 


0.505/ft 


7.00  ea 


10.00  ea 


229.0 


23.9 


4.0/ft 


119.0 


319.0 


241.0 


23-9 


95.0 


780.0 


2000.0 


2500 


Number 


.2 


2 


360  ft 


44 


32 


2 


36  ft 


2 


Fly-By-Wire  System 


Weight 

(lb) 

Volume 
(in. 3) 

Cost 

(dollars) 

49.8 

409.8 

1242. C 

19.58 

154.4 

470.0 

30.24 

119.52 

181.8 

12.276 

50.6 

308.0 

6.144 

100.48 

320.0 

18.36 

151.0 

458.0 

0.956 

7.85 

23.9 

5.796 

47.52 

144.0 

9.62 

78.6 

238.0 

25.6 

210.8 

638.0 

19.3 

156.2 

482.0 

0.956 

7.85 

23.9 

7.62 

62.64 

190.0 

27.28 

336.0 

6240 

27. 16 

223.44 

4200 

31.6 

259.2 

788.0 

27.16  223.44  4200 


1.48 

40.0 

400.0 

10.0 

160.0 

16000 

9.68 

96.0 

10,000 

TABLE  IX  (cent) 

B-52H  ROLL  CONTROL  SYSTB4  WEIGHT  AND  CO! 


Control  System 

Individual 

Component 

Weight 

(lb) 

Volume 

(in.5) 

Cost 

(dollars) 

Force  Feel  Spring 

7.62 

62.64 

191.0 

Electrical  (Shielded)  Cable 

0.023/ft 

.094/ft 

0.10/ft 

AFCS  Servo 

5.80 

47.7 

1500 

Mechanical  Syi 


Number  Y' 


Total  System 
Characteristics 


mrrpm 


TABLE  DC  (cont) 


I2H  ROLL  CONTROL  SYSTEN  WEIGHT  AND  COST 


Mechanical  System 


Fly-By-Wire  System 


Cost 

(dollars) 


Weight 

(ID) 


Volume 

(in.3) 


Cost 

(dollars) 


62.6k  191.0 


66k  ft  15.27  62. k  66.kO 
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Figure  85 

-52H  Rudder  Control  System  (Mechanical) 


Table  X  presents  the  weight,  volume,  and  cost  of  the  B-52H  mechanical 
rudder  system  and  the  equivalent  fly -by -wire  system.  The  fly-by -wire  system 
costs  approximately  2.5  times  as  much  as  the  mechanical  system,  but  It  pro¬ 
vides  a  weight  savings  of  135  pounds  and  a  space  savings  of  900  cubic  Inches. 

Table  XI  summarizes  the  data  for  comparing  the  B-52H  mechanical  control 
system  with  the  equivalent  fly-by -wire  system.  The  fly -by -wire  system 
shows  an  increase  in  cost  of  approximately  100  percent.  The  large  increase 
reflects  the  relative  simplicity  of  the  mechanical  system  which  employs  free- 
floating  tab  operated  surfaces.  For  the  Increase  in  cost,  a  fly -by -wire 
control  system  provides  a  reduction  of  50  percent  in  both  control  system 
weight  and  space.  The  space  savings  are  actually  greater  because  the 
analysis  uses  the  only  displaced  volume  of  the  mechanical  components  and 
ignores  the  space  allowed  for  their  motion.  The  fly-by-wire  system  pro¬ 
vides  a  few  hidden  and  additional  benefits.  It  eliminates  the  cable  rigging 
maintenance  which  is  required  perhaps  every  60  flight  hours  and  requires  2 
man-days  of  labor.  The  question  of  which  system  would  require  more  main¬ 
tenance  actions  cannot  be  answered  because  reliability  and  maintainability 
data  on  this  aircraft  are  not  readily  available.  However,  from  the  Vertol 
CH-46  analysis  described  in  paragraph  VIII. 3  of  this  section,  the  fly-by- 
wire  system  would  have  a  mean  time  between  maintenance  actions  of  250  hours 
and  have  a  maintenance  time  for  each  flight  hour  of  only  2  minutes.  The 
mission  reliability  of  the  two  systems  is  assumed  to  be  equivalent. 

2.  F-lll  FLIGHT  CONTROL  SYSTEM 

Aircraft  manual  pitch  control  is  achieved  by  symnetrical  motion  of  the 
all-movable  horizontal  tail  (elevon).  Direct  mechanical  linkages  run  from 
the  pilot's  control  stick  to  the  left  and  right  elevon  actuators.  Figure 
87  shows  the  direct  mechanical  linkages  and  the  pitch  damper  servo  which 
acts  as  a  ground  point  for  mechanical  inputs.  All  pitch  stability  augmen¬ 
tation  and  command  augmentation  signals  are  input  to  the  pitch  damper 
servo.  Trim  inputs  are  either  series  or  parallel.  The  artificial  feel 
system  in  the  pitch  axis  consists  of  fixed  springs  and  electrical  signals 
composed  of  normal  acceleration  and  angular  rate  feedback.  Figure  87 
shows  the  basic  components  for  the  mechanical  control  system.  The  components 
are: 


Control  stick 
Upper  control  quadrant 
Lower  control  quadrant 
Bellcrank  assemblies 
Pushrods  and  end  terminals 
Pushrods  (adjustable) 

Feel  spring 

A  fly-by-wire  equivalent  to  the  F-lll  mechanical  pitch  control  system 
is  shown  in  figure  88.  The  system  employs  quadruplex  position  transducers 
to  provide  both  conmand  signals  and  actuator  feedback  signals.  Left  and 
right  half  redundant  actuators  are  driven  by  quadruplex  electronics  and  servo 
amplifiers.  Stability  augmentation,  AFCS,  series  trim  and  coomand  augmen¬ 
tation  signals  are  sunned  in  the  electronics  and  drive  the  redundant  surface 


Stick  position  transducer 
Manual  trim  actuator 
Series  trim  actuator 
Damper  servo 

Elevator  surface  actuator 
Lever  assemblies 
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actuators.  Parallel  trim  is  still  maintained  to  provide  stick  trim  displace¬ 
ments  if  necessary.  The  "basic  components  for  implementing  the  fly-by -wire 
system  are: 

Control  stick 
Position  transducers 
Control  electronics 
Parallel  trim 

A  comparison  of  the  F-lll  mechanical  pitch  control  system  and  the  fly¬ 
by-wire  equivalent  is  presented  in  table  XII.  The  fly-by-wire  system  in¬ 
creases  the  cost  of  the  pitch  control  system  by  10  percent  over  that  of 
the  mechanical  system.  A  weight  reduction  of  98  pounds  and  space  savings 
of  400  cubic  inches  result  by  going  to  the  fly-by-wire  system. 

The  center  portion  of  figure  87  shows  the  mechanical  diagram  for  the 
F-lll  roll  control  system.  During  flight  conditions  where  wing  sweep  is 
less  than  45  degrees,  roll  conmands  are  applied  to  the  spoilers  and  dif¬ 
ferentially  to  the  horizontal  tail.  Spoiler  authority  is  45  degrees.  If 
the  wing  sweep  is  greater  than  45  degrees,  the  spoiler  system  is  locked  out 
and  all  rolling  motion  is  generat 2d  from  the  elevons.  Mixing  of  pitch/roll 
signals  is  done  in  the  mechanical  mixing  mechanism  shown  in  figure  87. 

Roll  stability  and  coranand  augmentation  and  roll  trim  signals  are  applied  to 
the  roll  damper  servo  which  also  acts  as  a  ground  point  for  pilot  mechanical 
inputs.  The  manual  control  of  the  roll  axis  of  the  F-lll  consists  of  the 
following  basic  components: 

Control  sticl. 

Control  link 
Elevon  torque  shaft 
Pushrods  and  end  terminals 
Bellcrank  assemblies 
Pushrods  (adjustable) 

Low  gradient-feel  spring 
High  gradient-feel  spring 

The  fly -by -wire  equivalent  of  the  F-lll  mechanical  roll  control  system 
can  be  seen  in  figure  88.  Quadruplex  position  transducers  on  the  control 
stick  provide  manual  conmand  signal  from  the  pilot's  station  to  both  the 
spoilers  and  the  horizontal  tail  actuators.  Identical  electronics  were 
assumed  for  the  spoilers  since  the  F-lll  now  haB  a  fly-by-wire  spoiler 
control  system.  No  additional  electronics  would  be  required  for  roll  control 
of  the  elevon  since  the  pitch  channel  electronics  would  be  used  to  drive 
these  actuators. 

Table  XIII  presents  a  comparison  of  the  F-lll  roll  control  system  with  an 
equivalent  fly-by -wire  system.  The  fly -by -wire  control  system  for  the  roll 
axis  of  tht  F-lll  can  be  developed  for  30  percent  less  than  the  mechanical 
system.  In  addition,  a  weight  savings  of  75  pounds  and  a  space  savings  of 
450  cubic  inches  is  obtained.  This  result  is  obtained  because  of  the 
compatibility  of  fly-by-wire  control  systems,  especially  when  the  surfaces 
they  control  perform  a  dual  operation. 


Damper  servo 

Stick  position  transducers 
Wing  pivot  switch 
Spoiler  actuators 
Spoiler  monitor 
Spoiler  cutoff  valve 


Feel  spring 
Servo  amplifier 
Surface  actuators 
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TABLE  X 


B-52H  RUDDER  CONTROL  SYSTEM  WEIGHT  AND  CC 


Control  System 

Individual 

Mechanical  Syt 

Component 

Weight 

(lb) 

Volume 

(inJ) 

Cost 

(dollars) 

Number 

Weight 

(lb) 

1 

Rudder  Pedal6 

12.45 

102 

310 

2 

24.90 

2( 

Control  Quadrants 

9-28 

76.1 

231 

2 

18.56 

E 

Cable  (3/l6  in.  Diameter) 

0.084/ft 

0.332/ft 

0.505/ft 

280  ft 

23.52 

92 

Pushrods  (5/8  in.  Tube) 

0.l6l/ft 

1.32/ft 

4.0/ft 

46  ft 

| 

6c 

Tumbuckles 

0.279  ea 

1.15  ea 

7-00  ea 

8 

2.23 

i 

Bellcranks 

7.50 

61.5 

187.0 

7  £> 

52.5 

£ 

Torque  Shaft 

8.74 

71.7 

218 

1 

8.74 

7] 

Tension  Regulator 

14.67 

120 

365 

1 

14.67 

B 

Servo  Quadrant 

4.65 

38.1 

116.0 

1 

4.65 

3* 

Trim  Mechanism 

5.61 

46.0 

140 

1 

5.61 

he 

Gust  Damper 

5-8 

49 

154.1 

1 

5.8 

4< 

Aft  Torsion  Bar 

5.7 

47.0 

173.5 

1 

mm 

4l 

AFCS  Servo 

5.80 

47.7 

1500.0 

1 

5.80 

41 

Position  Transducer 

0.125  ea 

1.25  in.3 

100.0 

— 

— 

-- 

Force  Feel  Spring 

11.7 

95  in.3 

289.0 

1 

11.7 

91 

Control  Electronics 

Power  Amplifier 

i.25 

20  in.3 

2000 

— 

— 

Control  Actuator* 

7.2 

160 

5000 

— 

— 

— 

Electrical  (Shielded)  Cable 

0.023/ft 

0.094/ft 

0. 10/ft 

— 

— 

— 

Cable  Pulleys  (4  to  6  in.) 

0.192 

3-14 

10.0 

8 

1.54 

2; 

q-Spring  and  Equipment 

27.5 

246.1 

748.0 

_ 

— 

— 

Total  System 

Characteristics 

— 

1 

1 

1 

1 

1 

1 

n 

1 

193.32 

ll 

♦Redundant  (Low-Force)  Actuator.  Not  Cannon  to  Both  Fly-By-Wj 


TABLE  X 


Cost 

(dollars) 


310 


231 


0.505/ft 


4.0/ft 


7.00  ea 


187.0 


218 


365 


116.0 


140 


154.1 


173-5 


1500.0 


100.0 


289.0 


5000 


0.10/ft 


10.0 


748.0 


Mechanical  System 

Number 

Weight 

(lb) 

Volume 

(in  T) 

Cost 

(dollars) 

2 

24.90 

204 

620.0 

2 

18.56 

152.2 

462.2 

280  ft 

23.52 

92.96 

l4l.4o 

46  ft 

|  f|r  J 

60.72 

184.0 

8 

2.23 

9.2 

56.OO 

IDa 

52.5 

430.5 

1309.0 

Fly-By-Wire 

System 

Weight 

Volume 

Cost 

(lb) 

(in.^) 

(dollars) 

24.90 

204 

620.0 

18  ft 


2 


2.89  23.76  72.0 


14.00 


8.74 


14.67 


193.32  1489.2  5808.20 


Not  Cannon  to  Both  Fly -By-Wire  and  Mechanical  System. 


59.37  I  600.1  14,821.6 


1 


Directional  control  of  the  F-lll  is  achieved  by  direct  mechanical 
linkages  between  the  rudder  pedals  and  the  rudder  actuator.  Stability  aug¬ 
mentation  signal  and  directional  trim  inputs  are  series  summed  with  manual 
inputs.  The  F-lll  rudder  system  has  automatic  authority  limits  which  are  a 
function  of  wing  slat  position.  For  slat  positions  less  than  70  percent, 
the  rudder  authority  is  limited  to  7-5  degrees  to  prevent  excessive  side 
loads.  When  the  slats  extend  beyond  70  percent,  the  feel  actuator  receives 
a  signal  from  the  slat  drive  system  to  change  the  rudder  authority  to  30 
degrees.  This  change  is  made  gradually  to  prevent  a  noticeable  change  of 
rudder  pedal  position.  A  monitor  circuit  warns  the  pilot  when  the  change 
is  occurring.  The  mechanical  directional  control  system  consists  of  the 
following  basic  components: 


Rudder  pedals  and  support 

Bellcranks 

Quadrants 

Cable 

Turnbuckles 
Pulleys  and  brackets 
Pushrods 


Cable  tension  regulators 
Variable  feel  actuators 
Fixed  gradient  feel  actuators 
Trim  actuator 
Damper  servo 
Surface  actuator 
Torque  tube 


A  fly-by-wire  rudder  control  system  equivalent  to  the  F-lll  mechanical 
control  system  is  shown  in  figure  38.  Pilot  input  at  the  rudder  pedals 
generates  outputs  from  quadruplex  position  transducers  to  provide  control 
signals  to  the  surface  actuator.  Electrical  feedback  signals  for  the 
actuator  are  generated  from  quadruplex  position  transducers  mounted  on  the 
actuator  output.  All  electronics  and  servo  actuators  are  quadruplex.  Table 
XIV  presents  a  comparison  of  the  F-lll  directional  control  system  with-  a 
fly-by-wire  system.  The  fly-by -wire  system  and  the  mechanical  system  cost 
approximately  the  same,  but  the  fly-by-wire  system  provides  a  weight  savings 
of  over  100  pounds  and  a  space  savings  of  over  600  cubic  inches. 

A  comparison  of  the  full  primary  flight  control  system  for  the  F-lll  with 
an  equivalent  fly-by-wire  system  with  respect  to  cost,  weight  and  space  is 
presented  In  table  XV.  The  fly-by-wire  system  resulted  In  a  weight  savings 
of  277*3  pounds  and  a  space  savings  of  O.85  cubic  feet.  Cost  figures  for 
the  two  systems  were  nearly  equal  with  the  fly-by-wire  system  being  approxi¬ 
mately  U  percent  less.  General  Dynamics,  during  an  intensive  weight  saving 
program,  made  a  study  on  the  F-lll  aircraft  similar  to  the  one  described 
herein.  Their  weight,  shown  in  parentheses,  corroborate  our  results. 


A  comparison  of  tables  XI  and  XV  for  the  B-52H  and  the  F-lll  respectively, 
shows  that  fly-by-wire  systems  in  general  would  be  smaller  and  lighter  than 
their  mechanical  equivalent.  The  trends  in  cost  of  the  systems  show  that 
mechanical  systems  are  cheaper  for  simple  systems  and  fly -by -wire  systems 
are  cheaper  as  control  systems  become  more  complex.  A  discussion  with  the 
B-70  controls  group  at  North  American  further  corroborated  this  cost  trend. 

The  fly-by-wire  control  system  for  a  B-70  would  reduce  control  system  weight 
by  approximately  675  pounds  and  would  result  in  a  90  percent  saving  in 
design  manhours. 
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TABLE  XII 


F-lll  PITCH  CONTROL  SYSTEM  WEIGHT  AND 


Control  System 

Individual 

Mechanical  £ 

Component 

Weight 

(lb) 

Volume 

(in?) 

Cost 

(dollars) 

Number 

Weight 

(lb) 

Control  Stick 

3-41 

28.0 

421.8 

2 

6.82 

Upper  Control  Quadrant 

7.61 

62.9 

273-6 

1 

7.61 

Lower  Control  Quadrant 

4.80 

39.3 

170.9 

1 

4.80 

Fixed  Length 

Pushrod  Assembly 

0.65/ft 

4.18/ft 

8.4/ft 

76.5  ft 

49.73 

Variable  Length 

Pushrod  Assembly 

0.73/ft 

5.32/ft 

13.14/ft 

12.3  ft 

8.97 

Be 11c rank  (2  in.  Arm) 

0.39 

2.70 

14.10 

4 

1.56  | 

Bellcrank  (3  in.  Arm) 

0.48 

3.26 

16.98 

6 

2.88 

Belle rank  (3-1/2  in.  Arm) 

0.52 

3.54 

18.44 

7 

3.64 

Bellcrank  (4  in.  Arm) 

0.56 

3.82 

19.90 

20 

11.20 

Bellcrank  (5  in.  Arm) 

C.64 

4.38 

22.82 

4 

2.56 

Bellcrank  (6  in.  Arm) 

0.72 

4.94 

25.74 

4 

2.88 

Artificial  Feel  Spring 

7.31 

60.0 

261.0 

1 

7.31 

Position  Transducer 

0.125 

1.25 

100.0 

3 

0.375 

Parallel  Trim  Actuator 

6.8 

30.0 

1800.0 

1 

6.8 

Series  Trim  Actuator 

6.8 

300.0 

1800.0 

1 

6.8 

Damper* 

Servo  Actuator 

18.35 

64.0 

6000.0 

1 

18.35 

Stabilizer  Surface 

Actuator 

9.68 

68.30 

4500.0 

2 

19.37 

♦Redundant  Hydraulic  Actuator  (Low  Force) 


< 


TABLE  XII 

LI  PITCH  CONTROL  SYSTEM  WEIGHT  AND  COST 


Mechanical  System 


Cost 

(dollars) 

Number 

Weight 

(lb) 

Volume 
(in. 3) 

Coat 

(dollars) 

421.8 

2 

6.82 

56 

843.6 

273-6 

1 

7.61 

62.9 

273-6 

170.9 

1 

4.80 

39-3 

170.9 

8.4/ft 

76.5  ft 

49.73 

319.8 

642.6 

13.14/ft 

12.3  ft 

8.97 

65.4 

161.6 

14.10 

4 

1.56 

10.8 

56.4 

16.98 

6 

2.88 

19.6 

101.9 

18.44 

7 

3.64 

24.7 

129.1 

19.90 

20 

11.20 

76.4 

398.6 

22.82 

4 

2.56 

17.5 

91.31 

25.74 

4 

2.88 

19.76 

102.96 

261.0 

1 

7.31 

60.0 

261.0 

100.0 

■ 

3 

0.375 

3-75 

300.0 

1800.0 

1 

6.8 

30.0 

1800.0 

1800.0 

1 

6.8 

30.0 

1800.0 

6000.0 

1 

18.35 

64.0 

6000.0 

4500.0 

2 

19-37 

136.6 

9000.0 

Control  System 


Component 


Lever  Arm  Assembly 

Control  Electronics/ 
Channel 

Servo  Power 
Amplifier/Channel 


Redundant  Stabilizer 
Actuator 


Electronic  Transmission 
Cable  (Shielded  #22) 


Total  System 
Characteristics 


no k  WJJM.  -  MV  WIMP 


TABLE  XII  (cont) 

PITCH  CONTROL  SYSTEM  WEIGHT  AND  COST 


Mechanical  System 


,  Coat  Number  Weight  Volume  Coat 

(dollars)  (lb)  (in. 3)  (dollars) 


Fly-By-Wire  System 


Number  y°luT 

(lb)  (in.  ) 


Cost 

(dolla. s) 


6000.0 


0. 10/ft 


90.0 

10,000.0 

320.0 

12,000.0 

17.6 

18.7 

654.6 

26,464.8 

Ik 


mn  nom 


5TT 


TABLE  XIII 

F-llI  ROLL  CONTROL  SYSTEM  WEIGHT  AND  C( 


Control  System 

Individual 

Mechanical  Sy 

Component 

Weight 

(It) 

Volume 

(irJ) 

C08t 

(dollars) 

Number 

Weight 

(lb) 

E 

Control  Stick 

3.41 

28.0 

421.8 

2 

6.82 

5 

Fwd  Control  Link 

4.09 

33-5 

146.1 

1 

4.09 

3 

Roll  Torque  Shaft 

3.69 

30.3 

132.1 

1 

3.69 

3 

Fixed  Length 

Pushrod  Assembly 

(1.0  in.  O.D.  x  1/8  Tube) 

0.65/ft 

4.18/ft 

8.4/ft 

34.9  ft 

22.69 

1 

Variable  Length 

Pushrod  Assembly 

(l.O  in.  O.D.  x  l/8  in.  Tube) 

0.73/ft 

5.32/ft 

13.14/ft 

18.1  ft 

13.21 

S 

Position  Transducer 

0.125 

1.25 

100.0 

3 

0.375 

*3 

Lever  Arm  Links 

3.41 

28.1 

122.1 

1 

3.41 

r 

c 

Spoiler  Surface  Actuator 

7.1 

58.0 

3100.0 

4 

28.4 

r 

c 

Damper* 

Servo  Actuator 

18.35 

64.0 

6000.0 

1 

18.35 

t 

Bellcrank  (2  in.  Arm) 

0.39 

2.7 

l4ll0 

3 

"  1 

1.17 

f 

Be  11c rank  (3  in.  Arm) 

0.48 

3.26 

16.98 

6 

2.88 

1 

Bellcrank  (3-1/2  in.  Arm) 

0.52 

3-54 

18.44 

1 

0.52 

• 

Bellcrank  (4  in.  Arm) 

0.56 

3.82 

19.90 

7 

3.92 

t 

i 

Bellcrank  (5  in.  Arm) 

0.64 

4.38 

22.80 

4 

2.56 

• 

Bellcrank  (6  in.  Arm) 

0.72 

4.94 

25.74 

1 

0.72 

' 

Control 

Electronic  c /channel 

1.0 

6.0 

1600.0 

2 

2.0 

♦Redundant  Hydraulic  Actuator  (Low  Force) 
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11  ROLL  CONTROL  SYSTEM  WEIGHT  AND  COST 


100.0 


122.1 


3100.0 


6000.0 


Ik'.  10 


16.98 


18.44 


19.90 


22.80 


25.74 


1600.0 


Mechanical  System 


Cost 

(dollars) 


421.8 


146.1 


132.1 


8.4/ft 


13.14/ft  18.1  ft  13.21 


3 


0.375 


3.41 


28.4 


18.35 


1.17 


2.88 


O.52 


3-92 


2.56 


0.72 


Volume 

Cost 

(in?) 

(dollars) 

56.0 

843.6 

33.5 

146.1 

30.3 

132.1 

145-8 

331.1 

96.3 

237.5 

3.75 

300.0 

28.1 

122.1 

232.0 

12,400. 

64.0 

6000.0 

8.10 

42.3 

19.56 

101.8 

3.54 

18.44 

26.7 

139.3 

17.52 

91.20 

4.94 

25.74 

12.0 

3200.0 

Fly-By-Wlr 

e  System 

Weight 

(lb) 

Volume 
(In. 3) 

Cost 

(dollars) 

6.82 

56.0 

1 

843.6 

4.09 

ED 

146.1 

3.69 

30.3 

132.1 

28.4  232.0  12,400 


2.24  15.3 


80.21 


?200 . 0 
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TABLE  XIII  (cont) 


P-111  BOLL  CONTROL  SYSTEM  WEIGHT  AND  i 


Control  System  Individual  Mechanical  S 

Component  Veight  Volume  Cost  NuiDber  Weight 

(lb)  (in.3)  (dollars)  (lb) 


Servo  Power 

Amplifier/Channel  0.5  6.0  500*0  2  1.0 

High  Gradient 

Artificial  Feel  Spring  11.6  72.0  374.1  1  11.6 

Low  Gradient 

Artificial  Feel  Spring  7-31  60.0  26l.O  1  7-31 

Electronics  Transmission 


Shielded  Cable  (#22)  0.023/ft  0.094/ft  0.10/ft  87  ft  2.01 


TABLE  XIII  (cont) 

11  ROLL  CONTROL  SYSTEM  WEIGHT  AND  COST 


Mechanical  System 

Fly-By-Wire 

COBt 

(dollars) 

Number 

Weight 

(lb) 

Volume 
(in. 3) 

Cost 

(dollars) 

Number 

Weight 

(lh) 

Volume 

(inT) 

Cost 

(dollars) 

500.0 

2 

1.0 

12.0 

1000.0 

2 

1.0 

12.0 

2000.0 

374.1 

1 

11.6 

72.0 

374.1 

... 

... 

... 

261.0 

1 

7.31 

60.0 

261.0 

1 

7.31 

60.0 

261.0 

0. 10/ft 

87  ft 

2.01 

8.19 

8.70 

227  ft 

5.22 

21.34 

22.7 

— 

136.20 

933-25 

25,775.1 

61.27 

477.44 

19,485.7 

TABLE  XIV 


F-lll  YAW  CONTROL  SYSTEM  WEIGHT  AND 


Control  System 
Component 


Rudder  Pedal  System 


Individual 


Weight 

(lb) 


12.1*5 


Volume 

(in. 3) 


102.1 


Cost 

(dollars) 


310.0 


Mechanical  S 


Number 


Weight 

(lb) 


24.9 


Rudder  Pedal  Supports 


3.90 


32.0 


139.0 


7.80 


Fvd,  Rudder  Bellcrank 


2.45 


18.3 


95.6 


4.90 


Forward  Cable  Quadrant 


3.21 


26.1 


97.1 


Control  Coble 

(3/16  in.  Diameter  Stl) 


0.084 /ft 


0.33/ft 


0.505/ft 


78  ft 


3.21 


6.55 


Turnbuckles 


0.279 


1.15 


1.0 


1.67 


Cable  Pulleys 

(4  to  6  in.  Diameter) 


0.192 


3-14 


10.0 


16 


3.07 


Tension  Regulator  Quadrant 


9-3 


87.O 


265.0 


9-3 


Variable  Feel  Actuator 


4.94 


27-9 


876.0 


4.94 


Fixed  Gradient 
Force  Feel  Spring 


6.31 


87.0 


261.0 


6.31 


Series  Trim  Actuator 


6.8 


30.0 


1800.0 


6.8 


Damper  Servo  Actuator 


18.35 


64.0 


6000.0 


18.35 


Rudder  Surface  Actuator 


9.68 


68.3 


4500.0 


Fixed  Length 
Pushrod  Assembly 


0.65/ft 


4. 18 /ft 


8.4/ft 


41.7  ft 


9.68 


27.11 


Variable  Length 
Pushrod  Assembly 


0.73/ft 


5- 32 /ft 


13-14 /ft 


12.04 


Bellcrank  (2  in.  Arm) 


0.39 


2.70 


14.1 


8.79 


1.17 


Bellcrank  (3  in.  Arm) 


0.48 


3.26 


16.98 


1.44 


TABLE  XIV 

'-111  YAW  CONTROL  SYSTEM  WEIGHT  AND  COST 


Mechanical  System 


Fly-By-Wire  System 


C08t 

(dollars) 


310.0 


139-0 


95-6 


97.1 


Number 

Weight 
-  (lb) 

Volume 

(in. 3) 

Cost 

(dollars) 

Number 

Weight 

(lb) 

Volume 

(in T) 

C08t 

(dollars) 

2 

24.9 

204.2 

620.0 

2 

24.9 

204.2 

620.0 

2 

7.8^ 

64.0 

278.0 

2 

7.80 

64.0 

278.0 

2 

4.90 

36.6 

191.2 

2 

4.9 

36.6 

191.2 

Control  System 


Individual 


Mechanical  Syi 


Component 

r — 

Weight 

(lb) 

Volume 

(in  T) 

Cost 

(dollars) 

Number 

Weight 

(lb) 

1 

Bellcrank  (3-1/2  in.  Arm) 

0.52 

3.5k 

18.44 

7 

3.64 

2l 

Bellcrank  (4  in.  Arm) 

0.56 

3.82 

19.90 

6 

3.36 

2J 

Bellcrank  (3  in.  Arm) 

0.64 

4.38 

22.80 

13 

8.32 

2 

Bellcrank  (6  in.  Aim) 

O.72 

4.94 

25.74 

2 

wm 

E 

Bellcrank  (8  in.  Arm) 

0.82 

6.09 

31.71 

5 

4.10 

3( 

Aft  Torsion  Bar 

4.32 

35.7 

232.1 

1 

4.32 

3! 

Control  Links  (Aft) 

1.44 

9.88 

81.3 

2 

2.88 

IS 

Position  Transducer 

0.125 

1.25 

100.0 

— 

1 

« 

1 

m* 

Control  Electronics/  ' 
Channel 

1.0 

6.0 

1600.0 

Servo  Power 
Ampl/channel 

► 

0.5 

6.0 

500-0 

— 

— 

m  ■ 

Redundant 

Rudder  Actuator 

12.3 

160.0 

6000.0 

— 

— 

mm 

Electronics  Transmission 
Cable  (Shielded  #22) 

0.023/ft 

0.094/ft 

0. 10/ft 

— 

1 

1 

1 

— 

Total  System 

Characteristics 

--- 

— 

— 

— 

174.1 

12 

TABLE  XIV  (cont) 

11  YAW  CONTROL  SYSTEM  WEIGHT  AND  COST 


Mechanical  System 


18.44 


19.90 


22.80 


25.74 


31.71 


232.1 


81.3 


100.0 


1600.0 

500.0 

6000.0 


0. 10/ft 


174.1  1266.5  16,881.5 


Fly-By-Wire  System 


Weight 

Volume 

Cost 

(lb) 

(in  T) 

(dollars) 

3.64 

24.78 

129.08 

3.36 

22.92 

119.40 

8.32 

56.94 

296.70 

1.44 

9.88 

51.48 

4.10 

30.45 

158.55 

4.32 

35-7 

232.1 

2.88 

19.76 

162.6 

Weight 

(lb) 

Volume 
(in  T) 

Cost 

(dollars) 

2.08 

14.15 

73-72 

10.0 

800.0 

80.0 

8000.0 

160.0 

6000.0 

17.6 

18.70 

663.6 

16,242.6 

12 
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If  the  trends  resulting  from  the  comparison  of  mechanical  and  fly-by-wire 
systems  are  extrapolated  to  the  advanced  aircraft  of  the  1970's,  one  can 
easily  see  that  fly-by-wire  control  systems  will  be  smaller,  lighter,  and 
cheaper. 

3.  ch-46  flight  control  system 

The  existing  cockpit  controls  of  the  CH-46  are  the  cyclic  control  stick, 
the  directional  pedals,  and  the  collective  stick.  Fore  and  aft  motion  of  the 
cyclic  stick  controls  forward  velocity  or  pitch  angle,  lateral  motion  of  the 
cyclic  stick  controls  lateral  velocity  or  roll,  the  directional  pedals  con¬ 
trol  yaw  rate  or  sideslip,  and  the  collective  stick  controls  altitude.  The 
primary  flight  controls  consist  of  the  lateral  cyclic  and  collective  pitch 
of  the  two  rotors.  Differential  collective  pitch  controls  the  pitching 
moment  by  increasing  (decreasing)  the  lift  force  of  the  forward  rotor  and  de¬ 
creasing  (increasing)  the  lift  of  the  aft  rotor.  Equal  changes  in  lateral 
cyclic  pitch  of  the  rotors  controls  the  rolling  moment.  Differential  lateral 
cyclic  pitch  controls  the  yaw  moment.  The  total  lift  force  is  controlled 
either  by  equal  change  in  the  collective  pitch  in  both  rotors  or  by  tilting 
rotor  disc  angle  of  attack  during  forward  flight.  Forces  in  the  horizontal 
plane  sire  produced  by  tilting  the  lift  vector  through  pitch  and  roll 
commands,  figure  89  shows  the  CH-46A  flight  control  system  block  diagram. 

The  fly-by-wire  system  replaces  the  current  mechanical  control  system  ex¬ 
cept  for  the  cockpit  controls  and  the  feel  system.  This  includes  the 
following  existing  equipment:  the  control  stick  dual  boost  actuators  (4), 
the  series  stability  augmentation  actuators  (6),  pitch  series  trim  actuator 
(l),  the  mixing  unit,  the  Bvash  plate  dual  boost  actuators  (4),  and  all  of 
the  related  interconnecting  links.  The  fly-by-wire  system  replaces  all  of 
this  equipment  with  stick  position  transducers  (4),  provisions  for  control 
signed,  shaping,  mixing  electronics,  and  swash  plate  actuators  (4).  The  swaBh 
plate  actuators  combine  all  of  the  functions  of  the  existing  swash  plate 
actuators,  SAS  actuators,  and  series  trim  actuators,  and  thus  eliminate  a 
considerable  amount  of  complexity  and  weight.  Eliminating  the  mechanical 
control  linkages  eliminates  the  need  for  the  stick  boost  actuators.  The 
electronics  sum,  shape,  mix,  and  blend  the  stick  position,  SAS,  and  ASE 
(automatic  stabilization  equipment)  signals  to  generate  the  proper  control 
signals  for  the  actuators.  Various  nonlinear  or  variable  control  functions 
can  be  inserted  in  the  shaping  electronics  to  evaluate  their  effects  on  con¬ 
trol  response  or  to  tailor  the  response  to  the  pilot's  taste.  The  ASE  sig¬ 
nals  interface  mechanically  with  the  cockpit  controls  through  electro¬ 
mechanical  servos  to  provide  parallel  stick  motions.  As  am  alternate  con¬ 
figuration,  the  ASE  could  be  interfaced  electrically  with  the  fly-by-wire 
system  (as  shown  in  figure  90),  and  thus  further  simplify  the  control  system 
by  eliminating  the  trim  servos.  Since  trim  motion  feedback  to  the  stick 
would  also  be  eliminated  by  this  approach,  it  is  not  reconmended  for  this 
application.  A  simplified  block  diagram  is  shown  in  figure  90;  implemen¬ 
tation  of  quadruplex  redundant  electronics  in  the  longitudinal  axis  is  shown 
in  figure  91.  (The  lateral  axis  would  be  similar.) 

The  system  components  can  be  grouped  into  control  stick  transducers, 
electronics,  and  actuators.  Die  design  employs  quadruplex  redundancy.  Each 
of  the  four  control  stick  or  pedal  transducers  consist  of  a  quadruplex  linear 
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Figure  89 

CH-1»6a  Flight  Control  System 
Block  Diagram 


Figure  90 

CH-46  Fly-By-Wire  System  -  Simplified  Block  Diagram 


synchro  or  LVDT  depending  on  the  space  available  and  motion  required.  Each 
transducer  occupies  about  3  cubic  inches  and  weighs  6  ounces.  DC  electronics 
are  used  as  discussed  in  Sections  V  and  VI.  The  electronics  are  packaged  by 
channels;  that  is,  all  channel  A's  for  the  four  axes  are  packaged  in  one 
chassis,  channel  B*s  in  another,  and  so  on  (a  total  of  four  units).  Each  unit 
measures  approximately  6  inches  x  4  inches  x  4-1/2  inches  and  weighs  approxi¬ 
mately  5  pounds  for  a  total  volume  of  108  cubic  inches  and  weight  of  20 
pounds.  (An  alternate  approach  which  could  be  used  packages  the  channels  by 
pairs  resulting  in  two  units  each  of  which  measures  approximately  12  inches  x 
4  inches  x  4-1/2  inches  and  weighs  9  pounds.)  The  total  electrical  cable 
weight  is  estimated  at  35  pounds. 

The  system  employs  the  quadruplex  fail-passive  actuator  which  is  de¬ 
scribed  in  paragraph  VI.  5>  model  4a.  Each  of  the  four  servos  measures 
approximately  20  inches  x  3  inches  x  6  inches  and  weighs  approximately  13 
pounds.  These  estimates  assume  the  use  of  1500  psi  hydraulic  supplies.  The 
size  would  be  smaller,  of  course,  if  3000  psi  supplies  were  used.  The  total 
system  volume  and  weight  then  becomes  1950  cubic  inches  (1.13  cubic  feet)  and 
115  pounds.  The  weight  of  the  CH-46  mechanical  system  is  500  pounds,  and 
the  slightly  larger  CH-47  system  (which  the  above  system  could  also  replace) 
weighs  833  pounds.  Thi6  represents  a  savings  of  385  and  718  pounds, 
respectively. 

The  sumnary  tables  of  predicted  failure  rates  of  the  system  components 
are  listed  in  tables  XVI  and  XVII.  These  values  were  obtained  by  using 
the  component  failure  rates  in  MIL-H13BK-217A  combined  with  estimates  average 
stress  levels  and  preliminary  parts  count.  In  cases  where  MIL-HDBK-217A  does 
not  contain  data  on  a  part,  Avco  Reliability  Engineering  Data  Series,  'or 
Sperry  field  data  is  used.  The  estimated  component  or  subassembly  failure 
rates  used  in  this  proposal  are  summarized  in  table  XVI. 

Because  of  control  signal  mixing,  the  reliability  of  one  longitudinal 
channel,  one  thrust  channel,  one  forward  collective  inner  servo,  and  one 
aft  collective  inner  servo  are  in  series,  as  is  the  reliability  of  one 
lateral  channel,  one  directional  channel,  one  forward  cyclic  inner  servo  and 
one  aft  cyclic  inner  servo.  That  is,  the  failures  in  these  channels  are 
detected  by  the  same  monitor  at  the  actuator.  Since  the  monitor  cannot 
differentiate  between  them,  a  failure  in  any  part  of  the  chain  is  construed 
as  a  failure  of  the  complete  chain.  Call  the  total  failure  rate  of  this 
signal  channel  As.  Assuming  that  two  channels  of  the  four  must  work  for  a 
successful  mission,  the  probability  of  failure  =  4  (Xst)3  for  both  the 
pitch-collective  and  roll -yaw  axes.  The  boost  actuator  calculation,  which  is 
separate,  assumes  that  the  actuator  cannot  Jam  and  that  one  actuator  of  the 
two  must  work  for  success;  therefore,  Pf  (actuator)  *  (Aftt)2  for  each  tandem 
actuator.  For  the  complete  system  then,  the  probability  of  failure  for  a  « 

1-hour  mission  is 


Pf  =  2  x  4(ABt)3  +  4(xat)2 
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FAILURE  DISPLAY 


Substituting  the  estimated  failure  rates 

Pf  =  2  x  4 [2(195  +  27.6)10"6]3  +  4(75  x  10"6  )2 

Pf  =  7  x  10-10  +  224  x  10"10 

Pf  «=2.31  x  10“8 

Our  reliability  criterion  is  Pf  »  1.5  x  10”^  each  hour  for  two  axes. 

Therefore,  the  reliability  of  the  fly-by-wire  system  exceeds  the  required 
value  by  a  factor  of  six. 

Mean  time  between  maintenance  action  (MTBM)  is  calf  ilated  directly  as  the 
inverse  of  the  total  failure  rate  of  the  system.  The  maintenance  time  for 
each  flight  hour  i6  estimated  on  the  basis  of  the  time  to  replace  similarly 
packaged  equipment  in  other  aircraft  The  mean  corrective  maintenance  time 
is  based  on  the  estimated  time  required  to  confirm  a  reported  fault,  isolate 
it  to  the  appropriate  replaceable  assembly,  remove  the  failed  assembly, 
replace  it  with  a  known  good  one,  and  retest  the  system  to  verify  correction 
of  the  fault.  Fault  isolation  and  checkout  after  correction  uses  only 
built-in  test  equipment  at  the  flight  line  level.  Maximum  time  to  isolate 
95  percent  of  the  potential  faults  to  a  replaceable  assembly  is  2  minutes 
(estimated).  Scheduled  replacement  of  components/equipment  on  a  predetermined 
basis  is  not  assumed.  The  predicted  mean  maintenance  time  for  each  flight 
hour  is  approximately  2  minutes  (table  XVITl).  From  Vertol's  maintenance 
records,  the  maintenance  time  for  each  flight  hour  on  the  CH-46  control 
system  is  about  30  minutes  as  compared  to  approximately  4  minutes  for  a 
fly -by -wire  system. 
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TABLE  XVI 


SUMMARY  OF  ESTIMATED  COMPONENT  FAILURE  RATES 


Component 

Number 

For  Each 
System 

Individual 
Failure  Rate 
Each  10°  Hours 

Total -Rate 

Each  10°  Hours 

Position  Transducer 

16 

10 

160 

(Linear  Synchro) 

Electronics 

Demodulator 

32 

2 

64 

Summing  Amplifier 

32 

1.5 

48 

Shaping  Network 

1 6 

2 

32 

Servo  Amplifier 

l6 

4 

64 

Comparator 

24 

4 

96 

Logic  Net 

k 

2 

8 

Power  Supply 

8 

8 

64 

Connector 

kk 

0.2 

9 

Actuator 

Single-Stage  Jet-Pipe  Valve 

1 6 

150 

2,400 

Actuator 

16 

35 

560 

Main  Spool  Valve 

8 

40 

320 

Resolver 

16 

10 

160 

Total 

3,985 

TABLE  XVII 

SUMMARY  OF  FLY-BY-WIRE  SYSTEM  RELIABILITY 


Components 

Number 

For  Each  Channel 

Failure  Rate  (A) 

Each  10°  Hours 

For  Each  Channel 

Electronic  Channel 

Linear  Synchro 

1 

10 

Demodulator 

2 

4 

Summing  Amplifier 

2 

3 

Shaping  Network 

1 

2 

Servo  Amplifier 

1 

4 

Power  Supply 

0.5 

4 

Connector 

2.75  (average) 

0.6 

27.6 

TABLE  XVII  (cont) 

SUMMARY  OF  FLY-BY-WIRE  SYSTEM  RELIABILITY 


Components 

Number 

For  Each  Channel 

Failure  Bate  ( A) 

Each  10°  Hours 

For  Each  Channel 

Servo  Channel 

Single-Stage  Valve 

1 

150 

Actuator 

1 

35 

Resolver 

1 

10 

Total 

195 

Boost  Actuator 

Main  Spool  Valve 

1 

4o 

Actuator 

1 

35 

Total 

75 

TABLE  XVIII 

MAINTAINABILITY  ESTIMATE 


Line  Replaceable  Assembly 

N 

Number 

For  Each 
System 

Failure  Rate 
Each 

106  Hours 

MTTR 

Mean  Time 
to  Replace 
at  Line 
(minutes) 

MTR 

Mean  Time*  1 
to  Repair 
(minutes) 

Stick  Position  Transducer 

4 

40 

30 

30 

Electronic  Assembly 

4 

96 

10 

60 

Actuator 

4 

860 

30 

240 

♦Includes  shop  repair  and  maintenance 

overhaul. 

Maintenance  time  for  each  flight  hour:  ^  ^ 

where  OH/FH  is  the  number  of  operating  hours  for  each  flight  hour,  which  is 
assumed  to  be  two. 


Mr.  4(40)  (30  +  30)  +M96Kl0__+_60)  +  4(860)  (30  +  240 ) 

FH  (106)(£)  (io6)(^  (lo^Ki) 


f|  (2400  +  6720  +  232,200) 


MT  .  i  .qp  minutes 
FH  flight,  hour 


MTBM 


Xx  3985  X  ic" 


=250  hours 
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SECTION  IX 


CONCLUSIONS  AND  RECOMMENDATIONS 


1.  CONCLUSIONS 

One  of  the  major  problems  facing  aircraft  designers  is  that  simple  direct 
mechanical  linkages,  cables,  and  feel  springs  for  manual  control  cannot  meet 
the  greater  demands  of  advanced  aircraft  control  system  design  requirements. 
These  complex  manual  control  systems  have  increased  requirements  for  space 
and  weight  in  aircraft  where  both  are  ct  a  premium.  Nonlinearities  such 
as  deadband,  hysteresis,  and  backlash  result  from  the  increased  compliance, 
inertia,  and  friction  of  complex  mechanical  devices.  These  nonlinearities 
degrade  the  performance  of  the  control  system,  and  as  a  result,  the  full 
capabilities  of  the  aircraft  are  not  realized.  Additional  control  problems 
also  result  from  temperature  variations  and  airframe  flexibility.  The  solu¬ 
tion  to  these  problems  is  to  replace  the  mechanical  system  with  a  fly-by-wire 
system.  The  problem  then  remains  to  establish  the  design  technology  and 
criteria  for  practical  fly-by-wire  systems  within  the  present  state  of  the 
art  in  control  systems  design  and  components. 

A  fly-by-wire  flight  control  system  is  an  electrical  primary  flight  control 
system  employing  feedback  such  that  vehicle  motion  is  the  controlled  parameter. 
No  mechanical  backup  is  used.  Fly-by-wire  provides  a  redundant  integrated 
flight  control  system  with  the  reliability  and  flexibility  necessary  to  solve 
the  increasingly  complex  problems  of  flight  controls.  The  analysis  in  this 
report  shows  that  additional  benefits  are  also  obtained. 

a.  Reduces  overall  weight  by  150  to  700  pounds  or  more 

b.  Recovers  a  major  part  of  the  volume  allowed  for  control  linkage 
and  cable  motion  thereby  increasing  the  UBable  spaqe  for  other 
subsystems 

c.  Improves  control  performance  by  eliminating  friction,  inertia, 
backlash,  compliance,  and  the  effects  of  temperature  and  body 
bending 

d.  Reduces  initial  controls  design  effort  and  simplifies  installation 
and  maintenance 

e.  Provides  feasibility  of  standardizing  flight  control  systems 
between  aircraft  and  increases  flexibility  of  cockpit  installation 

f.  Decreases  vulnerability  especially  if  self-contained  actuators  are 
employed 

To  meet  the  control  system  reliability  requirements,  fly-by-wire  controls 
employ  redundancy  techniques.  Redundancy  implies  an  increase  in  the  number 
of  components  which  would  appear  to  imply  an  increase  in  the  number  of 
maintenance  actions  required.  Modular  packaging  and  failure  reporting  cir¬ 
cuits  keep  maintenance  time  lew,  however. 
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The  study  has  determined  the  fly-by -wire  system  requirements,  established 
the  design  criteria,  developed  an  approach  to  system  design,  and  established 
the  availability  of  the  components  required.  The  primary  requirement  of  the 
flight  control  system  is  to  allow  the  pilot  to  control  the  flight  path  of  the 
vehicle  with  a  minimum  of  effort  and  error.  Hence,  the  system  includes  not 
only  the  link  between  the  control  stick  and  control  surface  but  the  artificial 
feel  system  and  trim  as  well. 

The  fly-by-wire  system  includes  the  following  functional  elements. 

a.  A  spring-centered  control  stick  (or  wheel)  with  an  electrical 
output  proportional  to  force  and  related  to  position.  The  stick 
may  be  located  at  the  center  or  to  one  side  of  the  cockpit 

b.  r*  feedback  (c*  *  +  Kp#  +  K3#)  in  pitch  and  angular  rate  in  roll 

and  yaw  to  provide  a  closed  loop  control  system  around  the  airplane. 

This  provides  good  artificial  feel  and  path  control  independent  of 
airspeed  and  altitude  and  the  aircraft  type  (within  a  given  class 

of  aircraft) 

c.  Electronics  for  signal  shaping,  sunning,  switching,  gain  control, 
and  monitoring 

d.  Control  actuators  which  combine  the  functions  of  the  power 
actuators  and  the  series  trim  and  stability  augmentation 
actuators 

e .  Trim 

f.  Power  sources 

g.  Failure  display  panel 

The  study  has  established  the  following  design  criteria  and  requirements 
for  fly-by-wire  control  system. 

a.  The  system  mist  remain  operational  after  any  two  failures  with  a 
probability  »f  system  failure  for  a  1-hour  flight  no  greater 
than  2.3  x  10-7. 

b.  Control  channels  from  stick  to  surface  must  be  quadruplex;  this  can 
mean  three  real  channels  and  a  model  or  four  real  channels.  The 
power  sources  must  be  at  least  independent  triplex  and  monitored. 

The  C*  sensors  must  be  at  least  triplex  with  self -test  capability. 

c.  The  system  should  be  able  to  operate  on  unregulated  and  un¬ 
synchronized  power. 

d.  Performance  must  be  undegraded  after  the  first  failure;  have  limited 
degradation  after  a  second  failure  in  the  same  axis;  and  fail  to  neutral 
or  a  preselected  trim  position  upon  a  third  failure.  Allow  the  pilot 
to  select  any  channel  after  a  third  failure  in  the  same  axis. 
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e.  Monitor  points  should  be  on  actuator  rate,  at  the  C*  signal  just  before 
sunning  with  the  coen&nd  signal,  and/or  just  before  the  servo  actuator 
input. 

f.  Failure  reporting  is  required  to  inform  the  air  and  ground  crews  of 
the  control  system's  status.  Failure  isolation  to  a  line  replaceable 
unit  is  required  to  minimize  maintenance  time. 

g.  Preflight  self -test  to  check  system  integrity  should  take  no  more 
than  30  seconds. 

h.  Channel  transfer  time  in  case  of  failure  should  be  kept  to  a  minimum 
(less  than  50  milliseconds  for  the  application  of  this  study). 

i.  Electronics  should  be  packaged  in  potted  modules  ly  channel  and 
physically  isolated  to  minimize  damage  effects. 

J.  Electrical  cables  should  be  protected  by  conduit  where  necessary 
and  be  separately  routed  to  minimize  damage  effects. 

The  components  chosen  for  use  in  fly-by-wire  systems  are  of  proven 
design  and  essentially  off-the-shelf  with  the  exception  of  the  actuators. 

Even  here  the  existing  technology  is  employed,  but  configurations  had  to  be 
found  that  were  compatible  with  the  higher  degree  of  redundancy  and  transfer 
time  requirements.  The  following  types  of  components  were  selected. 

a.  Position  transducers  are  inductive  and  brushless,  Buch  as  the  LVDT 
(linear  variable  differential  transformer),  induction  potentiometer, 
microayn,  and  E-core  variable  transformer.  These  include  control 
stick,  actuator  feedback,  and  C*  sensor  outputs. 

b.  Electronics  are  mixed  ac  and  dc.  Signal  shaping  and  summing  must  be 
dc  to  avoid  power  phasing  problems.  Fail-passive  design  requires  ac 
circuitry.  Both  microcircuits  and  discrete  components  ape  vised. 

c.  Conventional  rate  gyros  and  direct-measuring  normal  accelerometers 
incorporating  self -test  capabilities  are  used. 

d.  Reinforced,  stranded  copper  wire  (shielded  where  necessary)  should  be 
used  for  added  strength. 

e.  lhe  fail-passive  secondary  actuator  was  selected  because  it  ha6  a 
number  of  important  advantages  over  the  other  candidate  actuator 
configurations.  The  advantages  Include:  no  failure  transfer  time, 
fewest  number  of  moving  parts,  the  most  tolerant  of  channel  mismatch 
and  dirty  hydraulic  fluid,  and  the  lightest  and  least  expensive  design. 

Based  on  the  results  of  the  study,  our  conclusions  are  that  fly-by-wire 
control  provides  many  advantages  over  mechanical  flight  control  systems  and 
that  control  system  technology  has  reached  the  point  where  practical  fly-by- 
wire  system  designs  can  be  realized  today.  The  •  ain  obstacle  fly-by -wire  has 
to  overcome  is  the  lack  of  confidence  in  system  integrity  caused  by  a  distrust 
of  nonmechanical  system  reliability. 
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2.  RECOMMENDATIONS 


To  overcome  the  lac k  of  confidence,  an  existing  aircraft,  particularly 
one  with  known  control  system  problems,  should  be  converted  to  fly-by-wire 
control  and  flown  to  demonstrate  its  feasibility.  Then,  many  flight  hours 
will  provide  in-flight  proof  of  its  maturity  and  safety.  The  work  should 
progress  in  two  phases.  The  first  phase  should  be  to  build  an  experimental 
laboratory  model  of  a  fly-by-wire  system  to  demonstrate  its  operation  under 
simulated  failures.  This  model  would  also  demonstrate  the  use  of  state-of- 
the-art  components  and  the  effectiveness  of  existing  design  techniques. 

Construction  and  evaluation  of  a  laboratory  experimental  model  of  a 
representative  fly-by-wire  system  would  accomplish  a  number  of  ends.  First, 
it  would  demonstrate  the  system's  operation  and  performance  under  various 
failure  conditions;  second,  it  would  provide  data  to  establish  performance 
requirements;  third,  it  would  provide  a  test  bed  for  testing  other  techniques 
which  may  become  available  during  the  course  of  the  program;  and  fourth,  it 
would  provide  the  data  needed  to  design  future  flightworthy  systems. 

The  second  phase  should  be  to  convert  an  existing  aircraft  to  fly-by-wire 
using  the  data  from  the  experimental  model.  Initial  system  tests  should  be 
run  with  the  electrical  system  paralleling  the  existing  mechanical  system  in 
the  airplane  with  reversion  to  the  mechanical  system  available  for  emergen¬ 
cies.  The  initial  tests  would  uncover  any  problems  which  may  exist  as  they 
might  in  any  new  system.  After  flying  the  system  for  a  specified  number  of 
hours  without  using  the  mechanical  reversion  capability,  remove  the  mechanical 
system  so  that  the  fly-by -wire  system  can  continue  on  it 3  own  to  build  up 
flight  time.  Then,  by  putting  as  many  flight  hours  on  it  as1  possible,  the 
integrity  and  practicality  of  fly -by-wire  can  be  demonstrated.  Final  proof 
of  the  fly-by-wire  feasibility  can  only  come  in  this  way.  Successfully 
completing  this  step  should  provide  the  impetus  to  all  those  people  in 
industry  who  are  waiting  for  in-flight  proof  of  fly -by -wire  maturity. 
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SECTION  X 


GLOSSARY  OF  TERMS 


ACHIEVED  RELIABILITY  -  The  reliability  deronstrated  at  a  given  point  in 
time  under  specified  conditions  of  use  and  environment. 


ACTIVELY  REDUNDANT  SYSTEMS  -  Several  identical  channels  or  elements  which 
perform  normal  control  functions  simultaneously  and  identically  at  all  times. 

ARTIFICIAL  FEEL  SYSTEM  -  A  group  of  components  operating  in  conjunction 
with  the  pilot's  input  to  the  control  stick  to  artificially  provide  the  pilot 
with  control  pressure  cues  corresponding  to  the  aerodynamic  forces  and  re¬ 
sponses  of  the  vehicle. 

AVAILABILITY  -  The  fraction  of  the  total  desired  operating  time  that  material 
actually  is  operable. 


BREADBOARD  MODEL  -  An  assembly  of  preliminary  circuits  and  parts  to  prove 
the  feasibility  of  a  device,  circuits,  equipment,  system  or  principle  in 
rough  form,  without  regard  to  the  eventual  overall  design  or  form  of  parts. 

CJ,  -  A  blend  of  pitch  attitude  rate  (radians /second)  and  acceleration 
(radians/ second^)  and  normal  acceleration  (feet/second^)  according  to  the 
expression,  C*  »  K1«iz  +  Kg  4  +  • 

CATASTROPHIC  FAILURE  -  A  sudden  change  in  the  operating  characteristics  of 
materiel  resulting  in  a  complete  lack  of  useful  performance. 


C  ID  SEP  CENTER  VALVE  -  A  valve  in  which  the  output  spool  lands  completely 
overlap  the  valve  ports  when  the  valve  is  nulled  or  centered. 


COMPONENT  -  A  functional  part  of  a  subsystem  or  equipment  which  is  essential 
to  operational  completeness  of  the  subsystem  or  equipment,  and  which  may 
consist  of  a  combination  of  parts,  assemblies,  accessories,  and  attachments. 


CONFIDENCE  FACTOR  -  The  percentage  figure  that  expresses  confidence  level. 


CONFIDENCE  INTERVAL  -  A  range  of  values  which  is  calculated  from  the  data  so 
as  to  have  a  given  probability  (confidence  level)  of  containing  the  true 
value  of  the  universe  characteristics. 


CONFIDENCE  LEVEL  -  The  probability  that  a  given  statement  is  correct,  or  the 
chance  that  the  true  value  lies  between  two  confidence  limits  (the  confidence 
interval) . 

CONTROL  STICK  TRANSDUCER  -  A  component  attached  to  the  control  stick  which 
converts  either  the  stick  displacement  or  the  force  applied  by  the  pilot  to 
the  stick  into  a  proportional  signal,  usually  electrical. 
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DEBUGGING  -  A  reliability  conditioning  procedure  which  is  a  method  of  aging 
the  equipment  by  operating  it  under  specified  environmental  and  test  condi¬ 
tions  in  accordance  with  an  established  procedure  to  eliminate  early  failures 
and  age  or  stabilize  the  equipment  prior  to  final  test  and  shipment.  Some¬ 
times  called  ”burn-in". 


£  -  A  lov  amplitude  sinusoidal  signal  superimposed  on  the  input  signal 
to  the  servovalve  to  reduce  "stiction"  and  deadzone. 


IX. VR  TIME  -  The  total  time  during  which  the  system  is  not  in  condition  to 
perform  its  intended  function.  (Down  time  can  in  turn  be  subdivided  in  the 
following  categories:  repair  time,  logistic  time  and  administrative  time.) 


EARLY  FAILURE  PERIOD  -  That  period  of  materiel  life  starting  Just  after  final 
assembly  where  failures  occur  initially  at  a  higher  than  normal  rate  due  to 
the  presence  of  defective  parts  or  abnormal  operating  procedures. 


R1CAL  PRIMARY  FLIGHT  CONTROL  SYSTEM  -  A  flight  control  system  mechani¬ 
zation  wherein  the  pilot's  control  coamtands  are  transmitted  to  the  moment  or 
force  producer  only  via  electrical  wires. 


as  :  i  :•  w : 


IANICAL  ACTUATOR  -  a  mechanism  for  converting  electrical  energy 
into  mechanical  motion,  usually  rotary.  Also,  electromechanical  servomotor. 


EXPERIMENTAL  ENGINEER  IRC  MODEL  -  Components  and/or  devices  which  may  he 
either  actual  or  simulated  and  represent  a  model  of  some  particular  design 
whereby  system  performance  can  be  ascertained  by  application  and  instrumenta¬ 
tion  of  input-output  relationships. 


FAIL-ACTIVE  -  A  failure  condition  in  which  a  failed  channel  or  element  inter¬ 
feres  with  the  normal  operation  nf  a  redundant  channel  or  element. 


FAIL  NeUtRAL  -  A  mode  of  operation  of  the  flight  control  system  whereby  the 
flight  controls  assume  a  neutral  point  after  failures  have  either  put,  or 
tended  to  put  the  aircraft  in  an  unsafe  flight  condition. 


FAIL-OrHIATIOHAL  -  A  characteristic  of  a  system  in  which  normal  system  oper¬ 
ation  is  maintained  after  a  single  failure.  During  the  failure  occurrence, 
and  during  detection  and  switching  sequence  (if  required),  the  aircraft  shall 
not  be  placed  in  an  unsafe  or  unrecoverable  position.  In  cocmerclal  aircraft, 
passenger  comfort  and  awareness  must  also  be  considered. 

FAIL-PASSIVE  -  (l)  A  failure  condition  in  which  a  failed  channel  or  element 
cannot  interfere  with  the  normal  operation  of  a  redundant  channel  or  element; 
(2)  A  system  in  which,  due  to  a  failure,  system  operation  is  lost  without  a 
significant  output  to  interfere  with  operator  (i.e.,  pilot)  takeover. 

FAIL-SAFE  -  A  system  failure  condition  similar  to  fall-passive,  in  which 
small  transients  are  allowed  as  long  as  the  aircraft  is  not  placed  in  an 
unsafe  attitude.  It  is  a  term  related  only  to  the  application  of  a  system 
and  not  germane  to  the  classification  of  redundancy  techniques. 

FAIL-SOFT  -  Fail-safe. 
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FAILURE  -  The  inability  of  materiel  to  perform  its  required  function  within 
previously  established  limits. 

FAILURE  -  DEPENDENT  -  One  which  is  caused  by  the  malfunctioning  of  associated 
(Secondary)  items.  Not  independent. 

FAILURE  DETECTING  SYSTEMS  -  Determine  that  a  failure  has  occurred  by  using 
auxiliary  equipment,  and  switch  out  the  failed  equipment  to  achieve  the  re¬ 
quired  fail-passive  or  fail-operative  condition  of  the  failed  channel  or 
element . 


a.  Operator  Selection  -  Uses  the  operator  (i.e.,  pilot)  to  determine 
a  failure  and  to  perform  switching  required. 

b.  Channel  Monitor  -  Uses  a  comparison  between  an  operating  channel 
and  a  second  channel  (real  or  simulated)  to  determine  a  failure 
and  to  initiate  any  switching  required  to  achieve  a  fail-passive 
condition. 

c.  Shared  Monitor  with  Voting  -  Uses  disagreement  with  the  majority 
of  a  number  of  channels  or  elements  to  determine  a  failure  and 
thereby  to  initiate  switching  required  to  achieve  a  fail-passive 
condition. 

d.  Self -Test  -  Uses  a  test  signal  through  the  channel  or  element  whose 
output  is  compared  with  a  standard  to  determine  a  failure  and 
thereby  to  initiate  switching  -required  for  the  fall-passive  con¬ 
dition  of  the  failed  channel  or  element. 

FAILURE  -  INDEPENDENT  -  One  which  occurs  without  being  related  to  the 

( Primary)  malfunctioning  of  associated  items.  Not  dependent. 

FAILURE  MODE  -  The  physical  description  of  the  manner  in  which  a  failure 
occurs.  Also,  in  analysis  of  design  reliability,  a  description  of  the 
manner  in  which  an  equipment  function  may  be  affected  by  a  failure. 

FAILURE  RATE  -  At  any  point  in  the  life  of  materiel,  the  incremental  change 
ih  the  number  of  failures  per  associated  incremental  change  in  the  measure 
of  life  (cycles,  time,  miles,  events,  etc,  as  applicable). 

FEEDBACK  TRANSDUCER  -  The  component  of  a  closed-loop  control  system  or 
servomechanism  which  converts  the  output  into  a  related  signal,  usually  elec¬ 
trical.  A  proportionality  factor  (e.g.,  volts/radian)  specifies  the 
gain  as  required  for  the  design  of  the  servomechanism. 

FLY-BY -WIRE  -  An  electrical  primary  flight  control  system  employing  feedback 
such  that  vehicle  motion  iB  the  controlled  parameter. 

GAUSSIAN  OR  NORMAL  DISTRIBUTION  -  A  density  function  of  a  population  which 
is  bell  shaped  and  symmetrical,  and  which  is  completely  defined  by  two  inde¬ 
pendent  parameters,  the  mean  and  the  standard  deviation. 

GROUP  REDUNDANCY  -  Redundancy  applied  at  the  component  or  subsystem  level. 
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HARDOVER  FAILURE  -  A  failure  of  a  device  such  that  the  device's  output 
quantity  goes  to  its  maximum  value. 

HEkTe  -  Cycles  per  second. 

HUMAN  FACTORS  -  Facts  about  human  behavior  which  affect  the  design  of 
systems.  As  a  discipline,  its  goal  is  to  achieve  an  optimal  system  with  an 
efficient  man  working  in  a  safe  and  habitable  environment.  Such  a  man  will  be 
working  with  equipment  designed  to  maximally  use  his  capabilities,  and  mini¬ 
mize  his  limitations,  while  reliably  performing  tasks  that  men  can  do  better 
or  more  economically  than  machines. 

HYDRAULIC  ACTUATOR  -  A  device  for  converting  fluid  energy  into  mechanical 
motion. 

HYDRAULIC  SERV OACTUATOR  -  A  mechanism  consisting  of  a  servovalve  and  a  linear 
actuator. 

HYDRAULIC  SERVOVALVE  -  A  mechanism  which  converts  some  form  of  input  signal 
(electrical  or  mechanical)  into  a  proportions!  fluid  flow  or  pressure  which 
may  be  used  to  move  an  actuator. 

HYSTERESIS  -  Valve  hysteresis  is  the  difference  in  input  signs!  necessary  to 
produce  flows  increasing  from  zero  to  maximum  from  that  necessary  to  produce 
flows  decreasing  from  maximum  to  zero. 

IMPORTANCE  FACTOR  -  The  ratio  of  the  number  of  mission  failures  caused  by 
materiel  failing  to  the  total  number  of  failures  of  the  materiel.  The  re¬ 
lative  importance  of  the  particular  materiel  to  the  tote!  mission 
effectiveness. 

INDIRECT  MONITORING  -  Monitoring  of  components  or  subsystems  for  proper 
operation  to  determine  (by  inference)  that  the  system  is  operating  properly. 

INHERENT  RELIABILITY  -  The  reliability  potential  present  in  the  design. 

JET  PIPE  -  A  device  sometimes  used  to  provide  a  velocity  head  for  controlling 
the  position  of  an  output  stage.  It  consists  of  a  rotatable  nozzle  which 
proportions  flow  between  two  adjacent  holes  which  lead  to  opposite  ends  of 
the  output  member. 

LARGEST  VALUE  CEILCTOR  -  Selects  and  transmits  the  input  signal  with  the 
largest  magnitude;  independent  of  input  signal  sign. 

LIFE  CHARACTERISTICS  -  Failure  rate  plotted  as  a  function  of  the  measure  of 
life  (cycles,  time,  miles,  events,  etc  ,  as  applicable). 

LINEAR  ACTUATOR  -  Also  a  cylinder  or  ram.  An  actuator  consisting  of  a  movable 
element  such  as  a  piston  or  ram  operating  within  a  cylinder  bore.  The  ac¬ 
tuator  may  be  single  ended  or  double  ended. 

MAINTAINABILITY  -  The  quality  of  the  combined  features  of  equipment,  design 
and  installation  which  facilitates  the  accomplishment  of  inspection,  test. 
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servicing,  repair,  and  overhaul  with  minimum  time,  skill,  and  resources  in 
the  planned  maintenance  environment. 


MAJORITY  VOTE  LOGIC  -  A  binary  operator  which  selects  the  signal  which 
agrees  with  the  majority  of  tnree  or  more  signals. 


MEAN-TIME*-EE1WEEN -FAILURES  -  For  a  particular  interval,  the  total  measured 
functioning  time*  of  a  population  of  materiel  divided  by  the  total  number  of 
failures  within  the  population  during  the  measured  period. 


MEAN-TIME*-TO-FAILURE.  -  The  mear.  functioning  time*  at  which  the  first 
failure  materiel  becomes  expended. 


MEAN-TIME»-TO-FIR  ST -FAILURE  -  The  mean  functioning  time*  at  which  the  first 
failure  occurred. 


MECHANICAL  C0N1R0L  SYSTEM  -  A  manual  flight  control  system  in  which  the 
means  of  control  between  the  pilot’s  station  and  the  control  actuators  is 
through  mechanical  linkages  or  cables. 

MID -VALUE  LOGIC  -  An  analog  operator  which  selects  the  signal  having  the 
middle  value  of  three  or  more  signals. 

MISSION  RELIABILITY  -  The  probability  that  the  materiel  will  give  specified 
performance  for  the  duration  of  a  mission  when  used  in  the  manner  and  for 
the  purpose  intended,  given  that  the  materiel  is  functioning  properly  at 
the  start  of  the  mission. 

MODULE  -  A  combination  of  components,  contained  in  one  package  or  so  arranged 
that  they  are  common  to  one  mounting,  which  provides  a  complete  function  or 
functions  to  a  system  and/or  subsystem  in  which  they  operate. 

MONITOR  -  The  combination  of  a  model  or  real  channel  or  element  and  a 
comparator. 

a.  Model  is  a  dynamic  simulation  or  a  stored  transfer  matrix 
of  the  characteristics  of  a  real  channel  or  element. 

b.  Comparator  is  a  circuit  whose  output  reports  agreement  or 
disagreement  between  several  channels,  or  between  channels 
and  a  model. 

NONFAILURE  DETECTING  SYSTEMS  -  Achieve  fail-passive  or  fail-operational 
performance  without  failure  detection  or  switching. 

a.  Massive  Redundancy  uses  sufficient  identical  functional  blocks 
with  a  parallel  output  scheme  so  tnat  a  failure  of  one  equipment 
can  be  ignored  since  it  provides  a  small  part  of  the  total  or 
composite  system  output . 

b.  Inherent  Fail-Passive  pertains  to  channels  or  elements  which 
are  fail-passive  without  the  addition  of  failure  detecting  or 
logic  equipment. 
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c.  Logical  Selection  uses  a  logical  basis  for  selecting  an  output, 
from  several  channels  or  elements,  which  is  most  likely  to  be 
a  satisfactory  signal  for  the  system  output.  Included  here 
ave  mid- value  logic  and  self -organizing  systems.  A  system  may 
use  several  different  redundancy  techniques  in  different  parts 
to  achieve  fail-operational  capability. 

NORMAL  DISTRIBUTION  -  (See  Gaussian  distribution.) 

wom.K  FLAr'i'Kih  -  A  device  often  used  as  the  first  stage  to  proportion  the 
pressure  across  the  output  spool.  This  is  accomplished  by  varying  the  area 
of  the  /ariable  orifice  with  respect  to  a  fixed  orifice  by  varying  the  dis¬ 
tance  of  the  flapper  from  the  nozzle  which  passe.*  the  fluid. 

OPERATING  TIME  -  The  tine  period  during  rhich  the  materiel  is  performing  its 
intended  function. 

PRESSURE  CONTROL  VALVE  -  A  valve  in  which  the  output  load  pressure  is 
approximately  proportional  to  input  differential  current  irrespective  of  flow. 

PREVENTIVE  MAINTENANCE  -  A  procedure  of  periodically  checking  and/or  recon¬ 
ditioning  a  system  to  prevent  or  reduce  the  probability  of  failure  or  deteri¬ 
oration  while  in  service. 

PSEUDO-FLY -BY -WIRE  -  A  Fly-By -Wire  flight  control  Bystem  with  a  normally 
disengaged  mechanical  backup. 

PREVENTIVE  MAINTENANCE  -  A  procedure  of  periodically  checking  and/or  recon¬ 
ditioning  a  sys  „*m  to  prevent  or  reduce  the  probability  of  failure  or  deteri¬ 
oration  while  in  service. 

RANDOM  FAILURE  -  Any  failure  whose  occurrence  is  unpredictable. 

RETXINnA^rpr  -  The  exi stance  of  more  than  one  means  for  accomplishing  a  given 
function. 

REDUNDANCY,  PARALLEL  -  The  application  of  two  or  more  means  of  accomplishing 
a  given  task  in  a  system,  all  of  which  are  functioning  at  the  same  time,  but 
each  of  which  is  capable  of  handling  the  task  itself  in  the  event  of  a 
failure  to  the  other  means. 

REDUNDANCY,  gPANDBY  -  Redundancy  applied  to  a  system  to  supply  an  alternate 
means  of  accomplishing  a  task,  which  is  held  in  abeyance  until  a  failure  of 
the  primary  equipment  is  sensed  and  the  standby  equipment  is  actuated  to  take 
over  the  required  tank. 

RELIABILITY  -  The  probability  that  materiel  will  perform  its  intended 
function  for  a  specified  period  under  stated  conditions. 

STANDARD  DEVIATION  -  A  measure  of  the  spread  or  dispersion  of  the  distribu¬ 
tion  of  a  random  variable,  mathematically  expressed  as  the  positive  square 
root  of  the  second  moment  about  the  mean. 

SIGNAL  HIANSMT5SI0N  -  The  method  of  coupling  the  control  stick  signal  to  the 
surface  actuator. 

SIGNAL  TYPE  -  Ihe  format  of  the  control  signal;  e.g.,  dc,  suppressed 
carrier  ac,  pulse  width,  or  digital. 
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SIMPLE  REDUNDANCY  -  Redundancy  applied  at  the  system  level. 


SINGLE  STAGE  VALVE  -  A  valve  in  vhich  the  output  flow  is  controlled  by  a 
spool  directly  connected  to  the  electromagnetic  driver. 

gTATUS  REPORTING  -  The  process  of  reporting  failures  within  a  system.  With 
a  failure  detecting  system,  reporting  is  a  simple  indicating  process.  With 
a  nonfailure  detecting  system,  auxiliary  failure  detecting  equipment  is 
required.  However,  this  equipment  does  not  provide  for  the  fail-operational 
capability  of  the  system. 

SUMMER  -  The  component  utilized  to  algebraically  sum  signals.  Also  summing 
Junction. 

SYSTEM  COMPATIBILITY  -  The  ability  of  the  equipments  within  a  system  to 
work  together  or  perform  the  intended  mission  of  the  system.  In  a  broader 
sense,  system  compatibility  is  the  suitability  of  a  system  to  provide  the 
levels  of  field  performance,  reliability  and  maintainability  required  by  the 
military  services. 

THRESHOLD  -  The  minimum  amplitude  of  input  signal  to  a  servovalve  necessary 
to  obtain  measurable  flow. 

TQRQUER  MOTOR  -  An  electromagnetic  driver  which  provides  a  rotary  output 
displacement  directly  proportional  to  input  current.  Generally  the  arc  of 
rotation  is  so  small  that  the  displacement  may  be  considered  linear. 

TRADEOFF  -  The  procedure  of  trading  a  degree  of  one  attribute  to  gain  a 
degree  of  another  attribute,  e.g.,  a  degree  of  reliability  might  be  sacri¬ 
ficed  to  obtain  a  greater  degree  of  performance  under  certain  conditions,  or 
vice  versa. 

TWO  STAGE  VALVE  -  A  valve  which  contains  two  stages,  the  first  of  which  is 
similar  to  a  single  stage  valve  and  which  positions  a  second  stage  spool 
hydraulically.  The  second  stage  spool  then  controls  output  flow. 

USEFUL  LIFE  -  The  total  operating  time  between  debugging  and  wearout. 

VALVE  HULL  -  Refers  to  the  condition  where  the  flow  from  the  output  load  is 
zero  for  zero  input  current. 

WEAROlfT  -  The  point  at  which  further  operation  is  uneconomical. 

ViaAROITT  FAILURE  -  Those  failures  which  occur  as  a  result  of  deterioration 
processes  or  mechanical  wear  and  whose  probability  of  occurrence  increases 
with  time. 
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ier  y  notes. 

IE  SPONSORING  MILITARY  ACTIVITY:  Euler  the  mm  af 
the  dap  art  mental  project  office  ar  laboratory  apenaortap  fyrp 
fiti  far)  the  race  arch  aad  dowel  opmoat.  Include  addkeae. 

19.  ABSTRACT:  Baler  aa  abstract  giving  a  brief  aad  factual 
atMBMry  of  the  dacumaat  indicative  of  the  report,  avaa  t bench 
il  may  alaa  appear  elsewhere  ia  the  body  of  the  techaical  ra¬ 
part.  If  additional  apace  ia  repaired,  a  continuation  sheet  ahall 
ha  attached. 

Il  la  highly  desirable  that  the  abstract  af  classified  reports 
ho  unclassified-  Each  paragraph  af  the  abstract  ahall  aad  with 
aa  ihdicatiM  af  the  military  aacurity  ctaaaificatian  af  the  in- 
formalism  in  the  paragraph,  represented  aa  (Tt).  (S),  (CL.  or  (V) 


ewer,  the  suggested  length  ia  from 


i  ta  22S  words. 


14.  EEV  WORDS:  Eay  wards  are  technically  meaningful  terms 
ar  short  pbreeea  that  characterise  a  rapart  and  may  ha  uaad  aa 
tads  a  entries  for  cats  I  aging  the  report  Kay  words  must  ho 
sal  acted  so  Ctal  na  aacurity  classification  ia  repaired  Identi¬ 
fiers,  such  as  opuipnoat  erode  1  designation,  trade  mm,  military 
project  cede  aaaa.  geographic  location.  My  ba  used  aa  hay 
wards  but  will  ha  fall  aw  ad  by  aa  indication  af  technical  c  en¬ 
tail.  The  aasigyMMat  af  links,  ruins,  and  weights  ia  optional. 
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ERRATA  -  October  1967 

The  following  correction  is  applicable  to  AFFDL-TR-67-53,  UNCLASSIFIED 
Report,  July  1967. 

Page  15 

Delete  last  paragraph  and  Insert  the  following  paragraph. 


Another  problem  involving  control  routing  and  fuel  cello  occurred 
in  the  A-6A.  The  elevator  and  rudder  control  rods  in  this  airplane  are 
routed  along  the  top  of  the  fuselage  between  the  aft  fuel  cell  and  the 
airframe.  On  one  occasion  the  fuel  cell  vent  stuck  while  the  aircraft 
was  climbing.  The  tanks  over  pressurized  and  the  expanded  fuel  cell 
then  Jammed  the  control  linkages  against  the  airframe,  thus  locking  the 
controls.  The  pilot  van  able  to  place  the  aircraft  on  altitude  hold, 
since  the  longitudinal  series  servo  is  integrated  into  the  horizontal 
stabilizer  actuator,  and  then  vent  the  tank  by  dropping  the  landing 
gear.  This  freed  the  controls  sufficiently  to  permit  a  cafe  landing. 
This  incident,  although  one-of-a-kind,  illustrates  the  problem. 
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